Hah, this is a lovely question!
We've been using Keystone for our production applications at Thinkmill for over 2 years now, serving millions, if not billions by now, of users. So, it's totally secure and absolutely ready for production. Actually, not only ready for production, it's battle tested with huge, real world apps.
The version number doesn't reflect that, so the next major release (which is currently in beta and already used in production by us) is going to be v4.0.0! (see this announcement blog post: https://github.com/keystonejs/keystone/issues/3415)