Proposal: better key derivation functions

pbkdf2 is getting rather old. While it's still acceptable, society as a whole has put quite a lot of work into fast hardware for computing SHA-256 in the past decade. For this reason it is no longer the default recommendation. Specifically, as I understand it, bcrypt and scrypt are the standard boring choices these days (with argon2 sometimes showing up).

Cite: the "password handling" section of this essay gives the right answers for password handling as

Percival, 2009: scrypt or PBKDF2.
Ptacek, 2015: In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.
Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.

It would be nice if the web platform exposed something other than the "if nothing else is available" option.

[Edit a few years later: this conflates "password hashing" and "key derivation", which are different. bcrypt is a reasonable password hashing algorithm but not a reasonable KDF, per this. Fortunately both scrypt and argon2 can serve either role.]

No files or tests are named. Start by reading issue #265 and its linked password-handling essay, then inspect the existing Web Cryptography API treatment of PBKDF2; done would require a decided proposal for exposing an additional key-derivation option.