> The problem with that is that you inevitably run into this dialog with nothing else attached to the machine. How are you going to confirm the dialog?

That's only a serious issue for a keyboard, and for this specific situation the keyboard could be segregated (globally inactive) and require a specific sequence of action to be activated.

> Better to focus on isolating the keyboard driver from the rest of the OS, so the only thing it should be able to do is read in input from the keyboard and report it back to the OS.

The virtual keyboard can send whatever keypresses (and thus indirectly commands) it wants to the system.