That's the part that kept me from signing up for a trial account, too. For example, I'm sure there's a good reason why the 37Signals login is required instead of the API key, but I couldn't find an explanation for it anywhere.
I completely understand your concern about trust. As of now, we are small (just two of us). But we worked in small and big companies handling very sensitive customer data with integrity and professionally. If nothing, you can check out our linkedIn profiles. Also, you can always call us or email us to learn more how we operate. We hope that trust in our company will come with time.
Regarding 37signals requiring login/password, our service does realtime continuos synchronization and that cannot be achieved using only the API.