'?' works for me on Windows. Though please allow me to press escape or '?' again to hide the shortcuts. And switch focus to the popup and let me scroll it with j/k and up/down.
Another suggestion: 2 clicks for "Load Remote Images" is a bit annoying, particularly because on other email platforms it's one click, and I have a fair amount of senders where the "from" email address changes with each email, making it impossible to select load always. And for some senders I selectively decide to load images. The popup every time with text and settings is too heavy. Make this a single click link ("Load Remote Images"), and next to it add a gear icon with the drop-down settings and "Why is remote content risky?" info. If a user presses the "Load Remote Images" link, load the images and change that link to a label for the image loading settings gear, e.g. "Remote Image Settings"
The key bindings are all configurable (by us, for now, maybe by everyone eventually -- if anyone wants that). We'll work on improving them.