Appears to be a 6 row (rows are inputs) by 7 column (outputs) matrix, so it could have had up to 42 keys. The on key appears to be outside the matrix. (Pressing the on key takes TP11 to ground.)
Inputs:
Row 0 input is pin PC19
Row 1 input is pin PC20
Row 2 input is pin PC21
Row 3 input is pin PC22
Row 4 input is pin PC23
Row 5 input is pin PC2
Outputs:
Column 0 output is pin PC24
Column 1 output is pin PC25
Column 2 output is pin PC26
Column 3 output is pin PC27
Column 4 output is pin PC28
Column 5 output is pin PC29
Column 6 output is pin PC30
The matrix layout is pretty much what you'd expect, but with the rows running vertically and the columns running across the keypad. I've worked through it and can provide details if needed.
Couple of weird things.
1: PC30 is not listed as a valid I/O pin in my Atmel databook. Maybe it's not bonded out on the BGA or LQFP, but is present on the CoB variant used in the HP-20B?
2: I'm a bit surprised that the on key isn't using one of the wakeup inputs. (I'm sure that design choice will make more sense once I dig into the power management.)
Oh, it appears that bank A and B GPIO (50 pins total) are dedicated to the LCD column and segment drive.
Guess I need to find the analog inputs.