Is there a good way to distribute WPA2 keys within the 'enterprise'
So, it turns out that Loin supports iOS-style .mobileConfig profiles, so the answer is "distribute mobileConfig files like the macbook is an iPad."

I can't claim to have figured this out. The story went more like:

Helpdesk Guy: hey, the CEO just called me, can someone get his mac on the wifi now?
Me: Yeah, I'm in the office still, where is he?
Sysadmin Guy: Dude, you don't need to visit him, just send him the iOS mobile config file we use for the iPads.
Me: What? That works?
Sysadmin Guy: Yeah, it does you PC loving doofus
Me: [tests, it does open a newfangled window and holy smokes my mac has enterprise wifi] Wow, that does work, let me email this to the CEO.  

Anyhow, I did a little looking around for documentation. I did find some verification that other people are doing this, and I also found this apple training doc which might be what you are looking for.