I think we're mostly in agreement here. No method that involves entering private keys into a browser window is an ideal solution. I also agree that Vessel is a better solution from a security perspective than a browser extension, but it's definitely not better from a usability perspective when it comes to integration with websites (which is what the Steem blockchain is mostly all about). So in my opinion an open source browser extension would be the best of both worlds in that it would provide ease of use with Steem-based websites while also allowing the code to be reviewed and audited to ensure there's no shady business going on.