Not all communications around keys are of a sensitive nature. Virtually daily, we will communicate keys internally in order to clarify details regarding some activity. Applying AES to keys internally would only serve to hinder our operations & support efforts.
How often are you verbally communicating primary keys/id's internally within an organization?
I've never understood arguments against guid's, except for table performance with databases that might take a performance hit because of either inserts, or because data won't necessarily be partitioned in the "correct" order (e.g. MySQL writes to buffer pools).
Presumably this is after not taking your own advice of performing AES256 encryption on the key before sending it to the user?
Your three easy steps together seem a lot more complex than just using guids.