There's many ways to make a keylogger, from userspace down to the SMM layer of UEFI. Perhaps a better way to approach this would be to turn the threat model ar

There's many ways to make a keylogger, from userspace down to the SMM layer of UEFI. Perhaps a better way to approach this would be to turn the threat model around? If they have a keylogger, assume they have a rootkit. What needs to remain secure even when the platform is comprised? Try to get it down to some cryptographic keys, which you can then store on a smartcard, that you use with a card reader with hardware PIN pad. There's no keylogging the PIN on one of those, as the PIN is sent directly to the smartcard, without relying on the host. Obviously at that point the software asking you to sign something is probably compromised, but your cryptographic keys will remain protected, as will the PIN.