>Asking HN: is there an open standard that actually spells out 100% of a password management protocol with highly trusted implantations on both sides?

If you don't want to go full asymmetric cryptography, there's SCRAM. It doesn't specify pepper, but pepper can be added to salt like for any salted scheme: salt=hash(pepper, stored salt);