User space versus kernel security tooling

Quarantining every key on USB keyboard attach outruns the OMG Cable's 500ms payload

RoamSwitch pairs IOHIDManager with a CGEventTap to drop an unrecognised keyboard's keys in flight. The merit of the design is that it never has to guess how fast the attacker's firmware types.