What about internet banking on your phone? CarrierIQ has all of that login information...
In the interviews they've given after this whole blow up (such as the AllThingsD one I link to in the article), Carrier IQ said they don't log keystrokes - they just "listen" for a particular sequence of keys.
The example they give is that there is some secret code operator techs can as you to type in and then it sends them a bunch of diagnostic information.
So according to Carrier IQ, they check for a particular pattern of keystrokes, but don't record or transmit them.