[throwaway5371]

you can say the same about the widget, as the website embedding the widget has access to the document's keydown

[makingstuffs]

If the widget is in an iframe with a different host the parent documents JS engine has no way of interacting with the child.

[rhysmdnz]

The parent documents JS engine can replace the iframe with their own that looks the same