According to Keybase's documentation:
[The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find evidence of malicious rollback. They alert Alice when her tracking of Bob breaks, if either Bob or the server was compromised. They check the site's published Merkle tree root for consistency against known signature chains. And they sign proofs when all these checks complete, setting up known safe checkpoints to hold the server accountable to in the future.
And a bit later:
We fully understand that users of the Keybase Web client don't get these guarantees. But our hope is that enough users will use the Keybase command-line client to keep the Web users safe, by catching server misbehavior in the case of a compromise.
If you use the website to sign, verify, decrypt, or encrypt a message, you have to give up your private key and use your passphrase each time. Obviously, that's a risk. But if you sometimes use the website, will using the command line client verify the integrity of the server? Or do I need to trust keybase.io to not get hacked if I ever let it have my private key?