I decided the easiest way to find the keyboard I/O was to do a read scan of all the I/O addresses I found the HP firmware to be reading...  This did the trick!

Keyboard I/O is at port $D0, writing to this port outputs the row selects, and reading from it gives the matching columns.

Some trial and error later, we have our keymaps:

_keymatrix_unmodified:
	defb 080h,  '^',  ']', '\\',  '[',  'z',  'y',  'x'
	defb  'w',  'v',  'u',  't',  's',  'r',  'q',  'p'
	defb  'o',  'n',  'm',  'l',  'k',  'j',  'i',  'h'
	defb  'g',  'f',  'e',  'd',  'c',  'b',  'a',  '@'
	defb  '/',  '.',  '-',  ',',  ';',  ':',  '9',  '8'
	defb  '7',  '6',  '5',  '4',  '3',  '2',  '1',  '0'
	defb  ' ', 0feh, 0fdh, 00ah, 0f9h, 0f8h, 0f7h, 0f6h
	defb 0efh, 0e5h, 0e4h, 0e3h, 0e2h, 0e1h, 0e0h, 0ech

_keymatrix_shifted:
	defb 080h,  '~',  '}',  '|',  '{',  'Z',  'Y',  'X'
	defb  'W',  'V',  'U',  'T',  'S',  'R',  'Q',  'P'
	defb  'O',  'N',  'M',  'L',  'K',  'J',  'I',  'H'
	defb  'G',  'F',  'E',  'D',  'C',  'B',  'A',  '`'
	defb  '/',  '>',  '=',  '<',  '+',  '*',  ')',  '('
	defb 027h,  '&',  '%',  '$',  '#',  '"',  '!',  '_'
	defb  ' ', 0feh, 0fdh, 00ah, 0f9h, 0f8h, 0f7h, 0f6h
	defb 0efh, 0ebh, 0eah, 0e9h, 0e8h, 0e7h, 0e6h, 0ech

_keymatrix_control:
	defb 080h, 01eh, 01dh, 01ch, 01bh, 01ah, 019h, 018h
	defb 017h, 016h, 015h, 014h, 013h, 012h, 011h, 010h
	defb 00fh, 00eh, 00dh, 00ch, 00bh, 00ah, 009h, 008h
	defb 007h, 006h, 005h, 004h, 003h, 002h, 001h, 000h
	defb 01fh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh
	defb 0ffh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh, 0ffh
	defb 0a0h, 0feh, 0fdh, 00ah, 0f3h, 0f2h, 0f5h, 0f4h
	defb 0edh, 0e5h, 0e4h, 0e3h, 0e2h, 0e1h, 0e0h, 0eeh

 I've got a basic routine down that scans the matrix, and some iffy getkey routines that need better debouncing / key-release handling.  This is almost to the point of making Basic-80 usable (though without serial or disk I/O, it is of limited use) and makes some basic games playable.