That was our approach. Build it into the keyboard, do all the various secrets management (passwords, TOTP, et al) and message encryption behind a data diode (sorta air gapped). And RPi isn't the ideal compute module for it as you don't want a wireless chip on the inside of the "airgap". https://www.anomie.tech/

I’m not sure a RPI makes sense at all for stuff like this. They are so heavyweight compared to a little microcontroller board.