Planned (no capture for password fields and an opt-out for other text fields). An option might be also to just display stars on regular input fields, so you could see that users are typing, but not see what they actually type.
And it doesn't capture keyboard input except from known text widgets? My paranoia rests with pagewide onKey* hooks and the like. I'm not a JS guy, though, but I'd assume those are possible. That's why I was curious about total opt-out of key trappings.
Currently it only captures known input widgets, i.e. no global key strokes.