why not just throw a hash function in the middle? technically you're not increasing the search space for a brute-force attack (but that's not the goal), but you are probably slightly increasing entropy. and most of all, you avoid bad PR like this. :)

that said, it's probably still quite expensive and this PR isn't that bad.