Unless otherwise noted, this is with the calc ON in 84+ mode. OS 1.4 atm.
Also, I'll be referencing keys based on the BASIC 84+ getkey codes. so 101 is ON, 15 is graph, etc

1 - Ground
2 - Held High (Could be GPIO, could be Vcc, could be a fixed signal pin)
3 - Held High, turns to square wave when you press and hold any 10* key EXCEPT On (?) as well as down and Graph
4 - some form of square wave (my scope is crap, so I can't tell much. It can't actually sync to the wave. It IS a tube-based one, so I'm not surprised)
5 - Held High, turns to square wave when you press and hold any 9* key as well as left and trace
6 - Square Wave
7 - Held High turns to square wave when you press and hold any 8* key as well as right, zoom
8 - Square Wave
9 - Held High turns to square wave when you press and hold any 7* key as well as up, window
10 - Square Wave
11 - Held High turns to square wave when you press and hold any 6* key
12 - Square Wave
13 - Held High, turns to square wave when you press and hold any 5* key
14 - Square Wave
15 - Held High, turns to square wave when you press and hold any 4* key
16 - Square Wave
17 - Held High, turns to square wave when you press and hold Alpha, X-Var, Stat or Del
18 - Square Wave
19 - Held High
20 - Held High
21 - Held Low
22 - Held Low
23 - Held High, Link port wire
24 - Square Wave
25 - Held High, Link port wire
26 - Held High
27 - Held Low
28 - Held Low
29 - Held Low
30 - Held Low

Observations:
All Square waves change to Solid ON when the calc is in Standby.

The key layout for the pins is identical to the way they are layed out in memory, so bonus! That also means it'll be easier to get I/O Going.

since the key layout is the same, that means there are 3 bytes of input completely available for use, asssuming they aren't already used for that for the link port.

Thoughts so far:
3-17 are the pins for detecting the majority of the keys, at least for the rows.
I bet 19, 21 and 23 do the same, but since the 84+ doesn't use them they are unresponsive to any testing, and wouldn't show the square waves either.

I have a CAS and I modified the pad so it can fit, so this should closely replicate a touchpad, minus the touch module.