Actually, if I'm understanding things properly, I am suggesting the following design:
* "True" password iterations as a non-configurable property across all distributed servers (i.e. we enforce some strong level of security).
* "Cached" password iterations is really "local password iterations", which can be exposed to admins with this generic name.  If set, it takes the place of the underlying iterations.  So no need to qualify the name--for admins, setting it really is setting the password hashing iterations, as far as affects them (the local system).

I would also suggest that we either disable the Settings.get setting for password iterations, or we use it as a local cache copy as well.  I don't see any reason to let people configure things locally--even though I realize it slows down user creation / initial login.  There's no longer a need to compromise, as far as I can think.

Thoughts?