Is there a remote, trustless bitcoin API that doesn't require anything (blockchain/SPV headers) to be stored locally? This question asks about how to work with bitcoin via an API without requiring a local blockchain. The only answer is about blockchain.info's JSON API, but it appears that unlike the web version of blockchain.info, the JSON API requires the account passwords to be sent to the server.

Is there another remote API that allows one to perform various bitcoin operations without compromising security - without sending private keys anywhere, but rather signing transactions locally? The API should not require any downloads - SPV does not fall under this category - but should just be a remote API to the bitcoin network that doesn't require any state / bootstrap from its client.

If I recall correctly then Stratum was supposed to be this API. Did it ever take off?
The BOP Enterprise Bitcoin Server is an open source full node implementation with remote (that is client side) wallet. The server downloads the block chain does the transaction and block validation and routes transactions signed at the client.

The client connects to the server via a message bus. There is a Java and other APIs available with added client side features. Source code: https://github.com/bitsofproof/supernode

Commercial support and hosted instances available at http://bitsofproof.com