To be honest, I'm not as concerned with BC w.r.t. setPassword() because, overall, I get the impression setPassword() isn't that widely used. idk.

Other ideas: maybe we could have diff default values for diff kdf's. Alternatively, for kdf's that have a lower max length we could do min($password_key_size, $kdf_max_length) or something..