I've made many such composite devices (HID + mass storage) earlier, but not anymore. There are two problems. The first is that Windows doesn't like them any more. There's a ton of problems today with communicating with composite mass storage endpoints. They worked fine in Windows 2000 and Windows XP, but not so much anymore. I have no idea why - perhaps someone can educate me?
The second problem is that if you declare a mass storage device as part of your composite device descriptor, then your microcontroller code must handle the mass storage device requests. You cannot just relay them to another USB port byte by byte since the interface descriptors are (almost certainly) different. You can do this if you have another USB host port in your MCU: write USB host code that communicates with the USB flash stick (or even a totally different memory device such as SD card) and relay the block read and write commands between your composite interface and the other memory device. It'll work, at least with Linux and older Windows kernels.
But if you just want to have a simple USB port on the side of your keyboard, and you don't have any extra requirements (such as the keyboard being able to read the USB flash memory without the PC), then just grab a USD0.3 USB hub IC, put it on the same PCB, wire one of the ports to your microcontroller and the other(s) to external connector(s) in your product. The benefit is that your product is then standard, e.g. any kind of USB device(s) can be connected to the external port(s), including more hubs, and you have zero trouble with your MCU software.
[Edit] hmm... I got to thinking... I guess it could be possible to relay the MSC protocol commands (the USBC - data - USBS packets) to the other USB port, which would make the overall software implementation easier... but the other problems remain.