Seeking to understand the 16-pin interface between the main PCBA and the keypad.
Both connectors (the one on the main PCBA and the one on the underside of the
keypad) have silkscreen with pin numbers around them, but the numbers in these
silkscreen labels don't match: per the main PCB silkscreen, pin 1 is toward the
edge of the phone, whereas per the keypad underside silkscreen, pin 1 is toward
the middle.

Here I will use pin numbers per the main PCBA silkscreen.

Geometric centre of the footprint is at (3923,456) in steve-m's L8 scan.

Pin 2: *guess* may be KBC0

Pin 3: L8 trace to (4068,278), L7 damaged, guessing the middle trace in the
bunch of 3 found when tracing KBC0. Inner via at (4084,491). Found it on L2,
goes to (4107,482).  Goes to Calypso ball M5, or maybe N5.  N5 seems unlikely,
as it's a power pin, so must be M5 - but that is KBC4, which shouldn't go to
the main keypad.

Pin 8: connected to massive copper flood, almost certainly GND.

Pin 9: connected to a copper fill that's islanded by some traces, so it may or
may not connect the same massive fill (GND?) as pin 8.  In this island there is
a largish solid-connect via at (3915,475) and two smaller ones at (3766,539)
and (3911,507).  On L7 these vias connect to massive copper flood - definitely
GND.

The keymap given in OsmocomBB (confirmed to be correct) indicates that the main
keypad ought to use KBC0 through KBC3 and all 5 KBR lines.  The 3 side buttons
use KBC4 and KBR1 through KBR3.  Let's try tracing the KBC and KBR lines of
interest from the Calypso.

Tracing KBC0, Calypso ball N4: goes to via at (4122,380).  Found it on L2, goes
to a larger via at (4130,444).  Found it on L7, trace disappears into the edge
grind-down damage.  The trace disappearing into the damage is the leftmost in a
bunch of 3, the point at which the middle of the bunch is cut off is (4116,352).
A *guess* is that we may be going to connector pin 2.

Let's try tracing some signals from Iota.  Let's start with PWON (ball F8).
L1 trace from ball seems to go to (2767,974). On L2 it goes to two vias:
(2730,745) and (3312,194). Both vias are inner. Following (3312,194) first.
Unable to find it, edge damage gets in the way again.