I could easily do a tool to delegate SP based on SteemJS. But I'm not 100% positive on this feature, I don't really see why we should give tools to inactive users, instead active curators should get rewarded more. I made a post about a curation bot recently that I consider a good alternative to delegating SP. Maybe I'll do it still, I agree it would be used a bunch and it's quite an easy job.

Good question about security. I should have talked about it in the article.

Your key is never sent over the wire (of course), and you can check that with any tool you'd like (chrome F12-> Network), or even WireShark if you are paranoid . Still, even in that case, losing your posting key is not a huge trouble as long as you control the owner key (or password) as a potential stealer could only upvote or post for you, not steal your coins.

For the delegating SP feature, I believe it would require the active key, and that would be a bigger security concern for users.

However, I need to mention that any app that currently asks for your password (steemit, steemconnect/busy, steepshot, esteem, etc) is a bad security practise for STEEM in general. We should be using our posting keys or keys in general to stay safer. As a general rule, my tool will always ask for the lowest credential required for the action requested. That's one of the reasons why I opted for a simple posting key solution for this tool (instead of using for example steemconnect).