Why does DH-EKE require that public keys be indistinguishable from random?
In DH-EKE, Alice needs to encrypt her chosen public key with the shared password. If the public keys do not look random, an attacker can try to decrypt Alice's first encrypted message to recover a small set of possible passwords, merely by checking if the decrypted message belongs to the public key space or not. Note that this is an offline attack, which is the type of attacks that PAKE protocols aim to prevent.