I feel like it would be best to avoid using their extension, but I am more concerned with the features and security of their core products. And I would think i

I feel like it would be best to avoid using their extension, but I am more concerned with the features and security of their core products. And I would think it is analogous to running kbfs on a machine with a virus or keylogger. And one nice thing is your root key is still protected by a paper key which you can physically secure, and use to de auth any compromised device keys. For the casual user who is just getting into keybase, social integration like this may be worth the risk in order to help onboarding new users. Once they start seeing the real benefits of using keybase, they can delete the extension and still make use of the good stuff. Finally, keybase is open source right? They are a small team and might not have the resources to improve the extension, but just getting the first iteration out there might be enough to attract contributors who see its value and can improve its security.