KDF and salt storage
Since he isn't yet authenticated, how can I trust those who ask me for this salt? Because if I gave it to anyone who asks for it, it wouldn't make sense to use it. 


That's where you went wrong. Salts are public: their purpose is to be unique per derived key, not to be secret. The security analysis of the KDF must assume that any salt used is public, so publishing them to anyone who asks is safe. That's one of the defining properties of a salt, as opposed to a "pepper". Peppers tend to provide no benefit that can't be provided by increasing the cost parameters, and complicate storage, so they're not used much.