If HP was able to release a patch to remove keylogger is a very short amount of time, does that mean that they already know about the keylogger being in the production code and had a patch ready just in-case it was detected?
Perhaps they just recognised that it could explode into a Superfish sized PR problem and went to fire off some angry calls to Synaptics for not surrounding their debug prints with ifdef.
I wonder if the old driver was WHQL-certified as well... (Although I'm under the impression that just needs to pass the SDV)