And what about side channels? It should be relatively easy to link timing to each key pressed, for instance, if not outright extracting the encryption key from emitted signal power fluctuations.
These approaches are not just theoretical, they have been shown to work. And that's assuming the protocol itself is not vulnerable and has been implemented correctly. Moreover, I tend to use my keyboards a long time, making it likely that a new attack becomes possible over its lifetime.
Personal question, feel free not to answer: what is your occupation that someone would find so interesting as to drag over a truckload of RF equipment near your location to try to home in on your 2.4Ghz keyboard, which operates in one of the most saturated frequency ranges known to modern man? :)
