I heard from the dev that they are implementing DigiD to do the authentication for the distribution. With DigiD they only get your BSN, nothing more. Sounds good to me...