You could have the OS randomly generate a token and give it to the device and require it to repeat it each time it's plugged in.
Devices without tokens or with unrecognised tokens would need user approval, those with the correct one would be trusted. That still doesn't solve the problem of deciding if a device should be trusted or not though.
OK - so if I plug it into my computer, I'll get the same unique information that lets you identify it. Now I can plug my USB stick into your computer and pretend to be that device.
