Now a ControlBinding can have several InputControlDescriptor and ButtonAxisSource instances, but I have seen no way to define new sources. First of all, I think it would be a great idea for InputControlDescriptor and ButtonAxisSource a common base class, so it would be easy to define new custom sources.
For instance if I want to use a modifier key on one input device, but none on an other, how can it be done? Maybe there should be composite sources.
Yes, exactly this is something we are considering.
There are challenges involved because Unity’s serialization doesn’t support polymorphism (saving arbitrary derived classes). This is also why we currently have separate arrays for saving plain InputControlDescriptor and ButtonAxisSources. If every binding was a ScriptableObject it would be possible, but that has its own complications. If we find a good solution for this, allowing user-defined types of bindings is something we’d like to support.
Yes, polymorphism is an issue. I personally use the FullInspector asset from the store, which supports it very well. We use it in production for ca. a year.
If no other way is possible, you could use custom serialization. If FullInspector can do it, so can the Unity Team. 
But the best solution would be to upgrade Unity to support polymorphism.