EFI does, in fact, help here! There's an entire section of the spec dedicated to this topic. Unfortunately, Microsoft's requirements for boot speed mean that most devices won't initialise USB in the firmware unless an application explicitly attempts to read a key, and doing that means adding a couple of seconds to boot time.