Is there such a thing as shortcutable key stretching?
Let $p$ and $q$ be secret uniform random primes, and define $n = pq$.  Consider $s = 2^{2^t} \bmod n$.


Without knowledge of $p$ or $q$, the best way we know to find $s$ is to start with $2$ and square it $t$ times successively.  We can tune $t$ to force the other party to take arbitrarily many steps.
With knowledge of $p$ and $q$, we can use the shortcut $2^e \equiv 2^{e \bmod \lambda(n)} \pmod n$ by Carmichael's theorem, since $\lambda(n) = \operatorname{lcm}(p - 1, q - 1)$; then it only takes one division of $t$ by $\lambda(n)$ and about $\log_2 n$ squarings and multiplications modulo $n$ to compute the answer, no matter what $t$ is.


But suppose you use this protocol.  What happens when one of the parties skips town just before the protocol is done?


  BOB: Hey, Alice, the combination to the box the magic words are in is $2^{2^{t_b}} \bmod n_b$ where $t_b = 1\,000\,000\,000\,000$ and $n_b = \dotsb$.
  
  ALICE: Great!  The secret to the meaning of life, the universe, and everything is encrypted with the key $2^{2^{t_a}} \bmod n_a$ where $t_a = 3\,141\,159\,265\,359$ and $n_a = \dotsb$.
  
  BOB: Awesome, thanks!  By the way, $n_b = p_b q_b$ where $p_b = \dotsb$ and $q_b = \dotsb$.
  
  ALICE: Ha-ha, sucker!  Have fun chasing meaning while I go open your box of magic words!
  
  BOB: Blast!  It will take my ASIC three hundred years to compute this.


Another approach you could try—which doesn't involve shortcuts—is to have each party reveal the secret bit by bit (or letter by letter) in lock-step:


  ALICE: The first letter of my secret is C.
  
  BOB: The first letter of my secret is V.
  
  ALICE: The second letter of my secret is H.
  
  BOB: The second letter of my secret is L.
  
  ALICE: The third letter of my secret is U.
  
  BOB: The third letter of my secret is F.
  
  ALICE: The fourth letter of my secret is M.
  
  BOB: The fourth letter of my secret is E.
  
  ALICE: The fifth letter of my secret is P, spelling out CHUMP, because you've given me enough to guess the rest of your secret by brute force and I ain't given you diddly squat!


The trouble is twofold:


Bob shouldn't have proceeded to divulge any of the secret without a verifiable proof that what Alice gave is actually part of her secret.
The protocol favors whichever party has more computational power—that party can abort the protocol at any time and leave the other one in the dust.