The keyboard hook thing is safe - turns out the low-level keyboard hook is special, and it runs in the installing thread's context.

Having nothing better to do this evening I wrote my own version, which should run fine on Windows 10: https://github.com/tom-seddon/GfyKeys

It's very possible this isn't quite the same as the original, which I've still yet to actually experience - however you do get a click each time you press and release a key, so it's presumably not a million miles off.