Comment by tptacek

A secure storage system shouldn't allow passwords as keys. If passwords are a thing that is going to happen, the API should be structured so that those passwords get run through a KDF. That's what he's getting at.