Quick background:
I have solved my own question. It's not a 100% solution but it should cover most of what is needed. Hopefully there will be a cleaner solution when browser vendors start integrating DOM Level 3 Events.
Just to re-iterate the main constraints:
Without some out-of-the-box epiphany, the current browser implementations appear to prevent all three constraints from being fulfilled completely. So I have decided to relax constraint #3 just a bit.
On browser keyDown event add the event to a key down list and check to see if it is a safe (no undesirable browser default behavior) key combination:
Safe: do nothing until the keyPress.
Unsafe: report/send a key down event immediately. This is where constraint #3 is relaxed because these limited key combinations are not translated to a character code (many of them don't have them though anyways).
On browser keyPress event (which happens immediately after the keyDown event) check to see if it is a safe key combination:
Safe: report/send a key down event. Update the key down list using the translated character code (event.which).
Unsafe: do nothing since it was already reported/sent during keyDown.
On browser keyUp event, find and remove the matching event from the key down list and use the translated code to report/send the key up event.
Some additional links for those interesting:
This is an absolute minefield and I would urge you not to attempt this if you can possibly avoid it. Not only is there a long and tangled history of browser manufacturers not agreeing on key event behaviour, there is also the fact that they still don't agree and are still regularly changing the key behaviour of their browsers.
The following is the best I can offer and the definitive resource on browser key events: http://unixpapa.com/js/key.html
If you have to do this, I think you're going to end up with loads of key code mapping tables that will go out of date very quickly. Good luck.