EFF scorecard isn't meant to measure "how secure" an app is, it's supposed to measure how secure and free the application could potentially be.

Having key's held by the creator is a sure way to undermine any security model, having externally auditable code is a measure to ensure people can independently verify if code is secure or not (or if it's taking a carbon copy for it's creators) etc;