The "magic" provided by bitcoins was the "proof of work" part - basically trying to create only one "real" trusted branch of the markov chain at any point in time. But that "reality" has been broken multiple times by both the miners and the programers with voluntary and involuntary splits, double spends, etc.
> A Merkle tree provides an efficient way to compute hashes (not signatures)
A signature is a hash, in that it is effectively unique for the content. It simply has the additional property of being generated using cryptographic keys, proving that not only is the hashed content what's expected, it was generated using the specified key.
Though if we really feel it's necessary, we could simply say "a merkle-tree like implementation that uses cryptographic signatures in place of a hash function".
Pedantry about the difference between hashes and signatures doesn't change the validity of the structure as a response to the original question.
Alice and Bob both use asymmetric keys, and use one of a thousand different methods to exchange their public keys (hey, they can even go in the Merkle tree). Alice signs a transaction using her private key and publishes it. Bob can now use Alice's public key to verify the signature on the transaction. No private/secret key exposure.
Asymmetric encryption is a fairly well explored field, which is what makes the above both easy to reason about and secure.