The railway needs to solve this one itself by stopping using T-keys. They're everywhere, easy to make and there are lots of legitimate reasons for having one given that it's not only the railway that uses them. The railway needs to move to a more secure system, what makes sense may differ by application, e.g. cab locks may make sense to be electronic and opened by a fob, then there might be a key for locking doors out on that class of train in a box in the cab.
There is no practical way to prevent people getting T-keys, or indeed other keys that work some T-key locks (e.g. a house or car key can be used diagonally in a T-key lock without a pin - I've done this to open windows on a sweltering Class 166 with failed aircon to applause from other passengers and requests to open more, and I'd happily stand up in Court and defend having done so if the railway wanted to be awkward - the temperatures in summer on a 166 with the aircon out are a H&S issue).
The only thing a T-key should be able to be used for, if they're kept at all, is an application where you can't do any harm, e.g. opening a door panel fairing or other similar access panel but not being able to switch it on or do anything else nefarious.