Pretty all exchanges use private and public key. We sign API request with our private key using HMAC algorithm.
What's the point of doing so when there is already HTTPS connection?
HTTPS provides both data integrity and ensures security of the transmission.
Isn't it enough to just POST our credentials like api.exchange.com?key=key&private_key=private_key?
This is part of strategy known as "Defense in Depth." Each layer does not presume that the layers before or after it are certain to be secure, and takes measures to ensure security and verify security. HMAC signatures are one of those measures.
A HMAC signature preserves the integrity of the query so that a 0.1BTC purchase doesn't get changed to a 1.0BTC regardless of the security of the HTTPS transport.
The protections granted by SSL/HTTPS/TLS are not absolute and do have some clever attacks. In addition to some non-clever attacks such as the private key of the other side of the transaction being known to some third party (either by malice, hackers, or force of law). The same goes for other parameters needed for the integrity of the communication. There have been experimental Man in the Middle attacks where SSL transactions have been altered. The math wasn't broken, but other clever configuration changes were done. So the weak link there is people.
