Nobody has access to the private key except your wallet.
..Unless you wallet is running on a compromised general-purpose machine.
Call me paranoid; but you have to plan for the day Microsoft, Apple, Facebook, and Google may be compelled to steal your funds.
If you are paranoid the only thing you must do is signing your message from a cold address. ( or trezor like device)
And then login on your favourite site.
you dont use the same wallet for cold storage (or even hot storage of funds) as the one you use for authentication....derp
and where I said you had to use the same wallet or an address with funds
why dont have as much id/addresses as you need and use different ids for each site you need a different id.
if all this addresses comes from a cold wallet. you can sign offline and login without compromise your private key.