I haven't heard anyone else with this kind of concern. The way I'm distributing the keys is the way that itch io allows. I don't know how I'd be able to make the key available from your itch Io account page, as you describe
Neither do I. I am not a game developer and as such cannot be expected to know these things.
I am just informing you that I ,as a consumer, do not trust a .io website with the log in details to my steam library containing x amount of dollars worth of games to unlock a purchase of 18 dollars. Especially when I am expressly warned by the steam log in that itch.io is not affiliated with steam. Steam log-ins were leaked some ten years ago because third party sites sold user data to hackers. Humble bundle and other sites are affiliated with steam and as such I trust them more than itch.io.
An example of how to do it would I suppose be to do what the creators of the game "Torchlight" did a long time ago. Users were able to redeem steam codes once the game had made it on to steam by emailing the game developers through a specific email. The customer had to supply a copy of the receipt from the original transaction and were then emailed a steam code in return.
I imagine requesting these codes from steam would entail a similar process to the one game developers go through when they send review copies out to memebers of the press.