Excellent analysis, Steve.
You didn't mention, though you might have, the difficulty of
finding organizations that would be trusted to manage a conventional
KDC that would include the keys of a wide variety of organizations.
for example, look at the concern re the Clipper chip as to how many
individuals would be required to be corrupted in order to have
access to all of the keys of all of the major corporations. Maybe $10,000 to
$100,000 per employee per key escrow agency? If secret sharing is used
requiring 3 out of 6 employees, this is only $600,000, max. Sure beats building
Hellman's key-cracking engine, or using d\ivide and conquer approches to
factoring RSA keys. And some might do it for free, for non-monetary reasons
such as "cracking down on crime", etc.