ATProtocol does use keys, k256 key pairs by default. The PDS just puts a nanny password layer between the user and the keys, the same as the pseudo password thing that some Nostr clients once experimented with going back. ATProtocol you can start off self-hosted and have full control of your DID and your keys. Or you can start off with their hosting and later pull out your repo and your keys.