Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?
This is fine.  There is one corner case I would note which is that the message from 4 can be replayed in 6.  So the authenticated messages should include an indication of whether they are for step 4 or 6.  As for how short K can be: as long as necessary to get the guarantee you want from HMAC.