SHA-256 is commonly used for fingerprinting or for calculation of key check values (KCV's) even in Hardware Security Modules (HSM's). As the hash is a one way function it should be secure.

One thing to worry about is if the key is used for other purposes that include hashing. In that case you might run into issues with domain separation. In that case you could think of using a HMAC or KDF calculation instead, using a (presumably) unique string as input message (next to the key).

And yes, as always, the PBKDF is more vulnerable than the hash calculation for the check value. You'd be right to focus on that.

SHA-256 is commonly used for fingerprinting or for calculation of key check values (KCV's) even in Hardware Security Modules (HSM's). As the hash is a one way function it should be secure. However, that's only used to identify keys, not to proof that you have the key.

One thing to worry about is if the key is used for other purposes that include hashing. In that case you might run into issues with domain separation. In that case you could think of using a HMAC or KDF calculation instead, using a (presumably) unique string as input message (next to the key).

And yes, as always, the PBKDF is more vulnerable than the hash calculation for the check value. You'd be right to focus on that.