Maybe a good solution would be to request a less privileged token if the user doesn't want integration with private repos. Then, if they want to upgrade to integration with private repos they need to get a new oauth token with the relevant privileges.

I'd love to try this service out, but I also don't want to hand out oauth tokens that can read my ssh keys.

EDIT: Just read more comments and saw that my github ssh keys are completely public. I guess that makes sense since they are public keys!