After some further investigation, it appears that the keyboard input is actually captured by the application running in the foreground behind GDM. So if I leave a text editor open, lock the display, come back later and try to enter my password, whatever I type on the keyboard is entered into the text editor and not the password entry box in GDM.
After some further investigation, it appears that the keyboard input is actually captured by the application running in the foreground behind GDM. So if I leave a text editor open, lock the display, come back later and try to enter my password, whatever I type on the keyboard is entered into the text editor and not the password entry box in GDM.