This is great but kind of scary as you first have to give the private key to the app which you already mentioned to change but then you also sign events without having a way of verifying if you want to sign exactly those events.