Coinbase is likely clearing the transactions internally. They have control over the coins in the wallet (I just went and checked, they call their multi sig product something else), so they don't need to trust the user.

It relies on you having a BTC wallet with coinbase - where coinbase controls the private key.

So with coinbase you have no control over your private key? You can only spend your btc through coinbase?

If this actually relies on 0-conf transactions and assuming that you have control over your private key in coinbase, I wonder how replace-by-fee can impact this.

Probably Shift verifies that the correct key on the blockchain (ie correct coinbase user) holds the correct amount of bitcoin, then fronts the USD and does the bitcoin transfer on the back end.

Edit: downvotes don't tell me why I'm wrong, would appreciate counterexample, I don't see any docs on the Shift site, and there's no way in hell they're using zeroconf transactions at this scale, which means instant payments must come out of a USD account somewhere

so how does this relates to bitcoin?