Thanks for the input, we're facing the same issue with 802.1x. I'll be rolling out a device ACL to address the keychain sharing, then force those devices on to a separate network.
Have you noticed any slowness in the initial SSID connection using DPSK?