I don't think he was trying to imply it would be like being in control of your own private keys
He most definitely was, multiple times.
And yet again i repeat, an API key is an authentication tool that based on the service can do basically anything.... even ACT AS A PRIVATE KEY.
I realize that he just painted himself into a corner and is not going to back down no matter what, but when you're taking someone's money I think lying about the risks is not cool.
At some point he started asking me to send him $100, can't find it now. I think it was when I gave him my API keys and told him to help himself to my bitcoins since the API key "can act" as a Bitcoin private key...