In a full Windows device any controller or joystick would work, since you can manually install its driver, for a Windows RT device such as the Surface RT/2 the Xbox 360 controller driver is included in the O.S., hence no additional driver is needed, That's what happens when you try to connect a...
I think it is to hide the keypress, like when you type a text password, the virtual keys doesn´t get highlighted, so if someone is near you, he/she can't see your password, in this case your PIN.
I got this one at the local Best Buy, it fits the Surface pretty nice, and feels good too. It also has a pocket for accesories (like a stylus or HDMI cable)
HewlettPackard WV594AA - Best Buy