[Sohcahtoa82]

A hardware keylogger has to sit as a MitM between the keyboard and the USB port.

Sufficiently paranoid endpoint security could trip when the keyboard is unplugged and then plugged back in.

[dannyw]

That must have a lot of false positives for all but the most paranoid environments.