Or both parties are physically present to create or exchange the keys.

I'm not qualified to provide an answer, but the following article may be what you are seeking: arstechnica.com/security/2012/09/…

Thanks. I need to read your answer a few times, but this was the kind of insight I was seeking.

I agree - repeatedly injecting low entropy into a hash function just doesn't seem "right". In addition, the last 256 bits of the SHA256 input will be zero (as Ki/Ko are defined to be 512 bits and SHA256 has a 256 bit output and a 512 bit block size); again adding low entropy to the function. If I were to design a PBKDF I'd want to inject as much entropy as possible, but I also agree with the disclaimer.