423 ms is a pretty long time for a single keypress. If it were a normal keyboard, you'd be likely to miss keystrokes entirely. Unless this is a very, VERY slow keypad, nearly half a second is probably too slow.

I'd say you want to scan the keypad at a 50 ms +/- 20% rate. I doubt that anyone can strike a key and release the key within 50 ms, at least with a typical keypad. On a standard keyboard, intended for typing and not "push-this-button, then-push-that-button" operation, it should probably be 20 ms.

If you see a key pressed, store the value in a register. If, on the next scan, 50 ms later, that same value is present, simply wait for the idle code to return. If it doesn't there's some sort of error, e.g. a multi-key-press, or the like. If a single occurrence of a keypress occurs followed by the idle code, then it's valid. If, OTOH, it's followed by a different code, followed by the idle code, then it's the second code that's valid, since multi-key-presses are typically "misses" meaning that one briefly struck one key while trying to hit the other, so the correct one will persist. If you echo the input to a display of some sort, this error should become obvious to the user if it's misinterpreted, so, no harm, no foul, if you've provided a back-up key.

There are many ways to skin a cat.

RE