That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any

That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference. The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.