...You can lookup the keycodes in /usr/include/linux/input-event-codes.h.
The keypress logs are recorded in debugfs as long as the module is loaded. Only root or sudoers can read the log. The module name has been camouflaged to blend-in with other kernel modules.
You can, however, execute a script at shutdown or reboot (the procedure would be distro-specific) to save the keys to a file.