From a coding/development perspective this is a workaround not a fix, but it's interesting. Thanks for sharing.
I have a suspicion the trigger for invalid-key is about signal strength and things on the 'radio' side of WiFi, with the problem being related to how retries are handled. As we know reverting to wpa_supplicant also consistently eliminates the issue; the crack things fall down is probably in iwd, although "it takes two to tango" so interactions between iwd/connman that need examining.
The challenge is/remains: finding people with the code diagnostics skills to triage the issue, who can also replicate the issue.