Well, you are mostly correct. There are ways to distribute keys safely. You can use key derivation or you can set up transport key (yet another key, just to tr

Well, you are mostly correct. There are ways to distribute keys safely. You can use key derivation or you can set up transport key (yet another key, just to transport session keys). Both methods are allowed by PCI if done correctly. Unfortunately that's not what typically happens. Setting up infrastructure to transport keys safely is such a pain in the ass that, for SSL/TLS, I always recommend to just generate the key at the site of its intended use.