Why do I need to add my cPanel credentials at Step 1?

Only asked when the plugin can't use cPanel's command-line API to verify domain ownership automatically, and falls back to cPanel's web API instead. Credentials are encrypted and stored on the customer's own website server — not accessible to anyone else, verifiable by reading the plugin source.