I'm actually surprised they'd only ask for 10%...
But keep in mind that if you let ANYONE else to your coins, you never know what's going to happen to them. They might return your 90% or they might not.
Welsh is using a method that makes sure they can figure out the password, but not access the private keys once they got it. Similar to walletrecoveryservice. Thus its pretty safe if you follow the instructions. Payment usually works via escrow as well, because once the customer has the password they could just run.
Also, from walletrecoveryservices FAQ:
"Fortunately, the design of the bitcoin wallet is such that you can send us just part of the wallet information. The part you send us allows us to decrypt the wallet, without giving us any opportunity to steal your money."
More technical explanation:
https://bitcointalksearch.org/topic/m.2555111