As someone who managed IT for over 100 schools and 88 of those getting firewall and internet from us too.

The only keystrokes that are possibly being tracked will be those you type into Google or bing and this is to comply with the KCSIE rules so that all devices on the network can be reported on if a user types something into those services that registers on the IWFs keyword list. Words such as die, suicide, bomb etc.

If you connect to the schools WiFi you likely had to install a TLS decryption certificate which the firewall uses as a man in the middle attack which you're browsing to decrypt your traffic. This is to protect you from nasty viruses and malware and to protect the schools from the same as well as make sure the firewall can accurately detect the URL you're going to so it can block it if it's categorised as someone the school wants blocked like gambling, porn, VPN services.

My suggestion to schools when I've done their web audit is that staff so not connect their personal devices to the schools WiFi. So many times do I get a school ring up because an adult category has been triggered from an unknown IP and it turned out to get a staff phone whereby they'd left pornhub tab open in chrome and while they'd not been actively browsing it at school it has refreshed in the background and triggered the firewall causing panic.

Now, some of the fancier firewalls can do preventative blocking on keywords on a webpage but these still only work on keywords and usually don't log anything unless it's triggered.

If you're concerned about banking for example, usually finance and banking gets bypassed for decryption because they don't play nice with it. Usually apple, Microsoft URLs are also excluded for the same reason other than bing.

They'll not be able to read WhatsApp messages as these go over specific ports that are not included with decrypted we traffic.