Should we have one "sys-usb" per USB Controller?

[fsflover]

I thought that I should just reply in order to help those who use search and get here.

@Qubique

Is this intended to recommend that we place each USB controller in its own USB qube?

Yes, such approach goes along with the main point of Qubes OS: security through compartmentalization.

@Qubique

Assuming I only have two USB controllers and the keyboard is the highest risk device, would it be best to place the keyboard isolated on its own usb controller/qube?

Yes. However, it also depends on your threat model. For instance, if you have some USB device as trusted as the keyboard, you could also use it on the same USB controller as the keyboard.

@Qubique

Would it be more secure to use PCI-E cards to add USB controllers so that USB devices can be further compartmentalized?

Yes, people are doing this.