I have seen some applications use key expansion when deriving AES-keys. E.g. the application will generate some random data (e.g. 128bits), then use PBKDF2 to expand it into 512bits (2x256 keys).
Why go through this process of taking a small amount of random and expanding it, instead of taking 512bits cryptographic randomness directly?
The random 'seed' value is not stored either so it can be reused for the key expansion.