Keychron: disable VIA_INSECURE by default

[MateusWagnitz]

Summary

Remove the global VIA_INSECURE opt-in from Keychron's common
firmware build flags.

The current Keychron configuration defines VIA_INSECURE globally.
This allows VIA's id_switch_matrix_state command to expose the raw
physical keyboard matrix over Raw HID.

QMK upstream has documented this behavior as a security concern because
matrix-state polling can be combined with keymap information to infer
physical keystrokes.

Upstream references:

• Mitigate VIA keylogger security issues qmk/qmk_firmware#25414
• QMK 2025-08-31 changelog: "Mitigate VIA keylogger security issues"

Current behavior

Keychron's common build flags include:

-DVIA_INSECURE

When enabled, VIA's matrix-state handler can return the physical matrix
state through matrix_get_row().

The existing VIA implementation already provides a safe fallback when
VIA_INSECURE is not defined.

Change

Remove -DVIA_INSECURE from Keychron's global OPT_DEFS.

No changes are made to the VIA protocol implementation itself.

Security impact

This prevents unrestricted raw keyboard matrix reporting from being
enabled by default in production builds.

Normal keyboard HID input is unaffected.

VIA functionality that does not depend on raw matrix-state polling
remains available.

VIA Matrix Test functionality that relies on
id_switch_matrix_state will no longer receive physical matrix state.

Validation
git diff --check passes.
make keychron/q1_max/ansi_encoder:keychron completes successfully.
The build no longer emits:
VIA_INSECURE is enabled - firmware is susceptible to keyloggers

No hardware flash/testing was performed as part of this change.

Compatibility note

Internal Keychron manufacturing or diagnostic tooling that depends on
VIA's id_switch_matrix_state should be validated separately.

If unrestricted matrix-state access is required for factory tooling, a
dedicated factory-build opt-in or a secure physical-unlock mechanism
would avoid enabling this capability globally in production firmware.


https://github.com/qmk/qmk_firmware/pull/25414

https://docs.qmk.fm/ChangeLog/20250831