Different protocol for startup, where you select the keyboard you want. For a desktop with a good keyboard and a malicious USB both plugged in, it is going to

Different protocol for startup, where you select the keyboard you want. For a desktop with a good keyboard and a malicious USB both plugged in, it is going to need some way to know which one to go with anyways. The real threat is someone plugging in the bad USB after they are logged into their machine, at which point you already have a good keyboard (or are using mouse + onscreen keyboard). Maybe even don't go with any keyboards to start, only a mouse and an onscreen keyboard and all others have to be approved.