There doesn't seem to be a way to change my password for tngl.sh without using the central Bluesky instance. I shouldn't enter credentials on a bsky.app domain for a tngl.sh identity. (Or at least, that's how the Web trust model works. It's possible I'm misunderstanding something about ATproto.)
I also had to enter my tngl.sh password on bsky.app just to log in, but I understand that having Bluesky use OAuth is outside this site's control.