It is meant to private but the posting key is the 'lowest level' of security. The posting key only allows you to post a video, comment, and upvote. Even if someone else has your posting key, they won't be able to steal your money, just upvote for you.

Also, DTube is serverless and your key isn't stored anywhere but in your computer, so it never enters any device that I control.