Is this app doing nasty things if an unrelated calendar certificate won't verify?
At first glance, the app seems well enough reputable that it's not malicious, but I would send a support request to the vendor to ask how the password was stored/transmitted and if your version of the app is the latest.

Also, you don't explain which specific password was asked for? Perhaps you could edit the post to show that dialog (is it the normal asking for admin permissions - if so, that's an OS request and your password is safe on the Mac and the Mac is only as safe as the changes that were made on your behalf). If you went and changed that password, in almost all cases, you're closed the chance that you are vulnerable going forward assuming they don't harvest email and try that password on other accounts they have the potential to identify.

You could also use the Keychain Access -> Certificate Assistant to verify several certificates you know to be good so that you are comfortable that your keychain is intact. Having something show bad (false positive) is far less worrying than having a bad cert show good. Lots of things can have the former happen and that doesn't really put much at risk when communications are stopped due to a security check.