2 questions, 

Is this per controller? Meaning can I mitigate by using a dedicated "secure" USB controller for those devices.

Would you also try to isolate your signet, onlykey, yubikey and similar devices in this way?