So to be clear you want such a program to be implemented to be running as root in a way that the user can't individually control its just another root daemon that the user may or may not be aware of.
Of course a custom extension can also be created for this use-case, in which way the compositor can allow/deny access for keypresses to specific windows. But to be honest a central hot-key manager where apps can register new bindings (and with compositor managed multiple bindings resolution instead of the ad hoc way under X) would be a great target.