But what’s the difference between giving your nsec to alby or giving it to a website?

I get that you can then use Alby to login to multiple websites so it’s safer than proving your key to multiple websites, but you still need to trust alby, no?