> require the user to type a random combination of keys shown on the screen before enabling a given input device

If you could type it on any device, and you could guarantee that the OS could remember that device, I could see that being workable.

I would also worry about:

Ensuring that the keys shown bit is properly accessible to screen readers/braile devices, etc.

Ensuring that automation could authorise a device, or disable the prompt requirements

Ensuring that the OS actually remembered it. Plugging into different docks at home/work/conference room and having it prompt you to re-authorise your keyboard would drive people up the wall. eg: because during USB Enumeration the port numbers on your dock got switched, or they plugged the dock into the other side of their computer, or the Wireless USB controller is slow at starting up.

How to handle an unauthorised device when there's no other usable input devices. eg I started up my HTPC, and a few seconds later the IR receiver wakes up and is now marked as unauthorised - the device may not have a keyboard but that receiver appears as one. Or maybe I'm trying to fix a laptop and the on-board keyboard is broken, so how do I plug in a USB keyboard to get at the data on it (Maybe I can't reboot)

Some of these things might conflict with having such a lockout.