On the plus side, I'm pretty sure you have to actually sign up for Post+, if only because they need some sort of payment information. (And it looks like that information is going through Stripe, so it's not entirely the worst idea in the world, in terms of infosec.) Other than that, I'm thinking Xkit is our best bet.