I found five locations in the matrix which are not used by the keyboard but do send scancodes to the PC!
All I did to find them was connect my keyboard to the PC and use a breadboard jumper cable to connect the solder pads sequentially, using a keyscan program to record the results. I compared the lists of scancodes I got this way to the list of scancodes I got from pressing every button on the keyboard and found five unique codes after confirming. There could be some that I missed but five will do (I figured I might as well add another three switches).
Quite a lot (I guess all the other 21) of the unused matrix positions seem to result in a beeping noise being played through my speakers (or headset). That's kind of strange and doesn't sound like a normal Windows error noise but I guess they aren't usable positions and this is how the system communicates that something is wrong.
I checked the resistances of two different switches and got 70 and 100 ohms. I don't know if that's typical.
I'm thinking of using switches like the ones in the below photograph which I will glue in position on the case. I'll lead the wires along the top of the case too and try to give it the cyberpunk look that's so hot right now