Make the USB gate wait for usbguard before it decides at boot
Ship the USB keyboard gate, so deny-unknown has a release valve