>it remains the problem of distributing that password to the client in a secure way.

That's no different. It uses the same channel the user would send the password to it.