Why do 2^16 rounds of a designed-to-be-fast SHA-256 when there are deliberately slow PBKDF, such as scrypt?