Perfect Forward Secrecy with Pre-shared Key
A possible deficiency is that if the use made of any $K_j$ allows it to leak, all later security is lost. That makes $K_j$ plain unsuitable in some uses, e.g. directly as keystream for short messages.

The $K_j$ must be wide enough that it is extremely unlikely that a cycle is ever reached in deriving them. For plausible parameters that translates to $n^2&lt;2\cdot|K_j|\cdot\epsilon$, where $\epsilon$ is a small acceptable residual risk, and $|K_j|$ is the bit width of $K_j$. If $K_j$ was a 128-bit key, with 100 keys per microsecond for a decade, I get $\epsilon\approx2^{-19.4}$. That could be a problem when some requirement prescribes a very low $\epsilon$, like $2^{-40}$.

The above two can be solved with a wide key (and hash), derived into a working key (perhaps shorter) using a Key Derivation Function such as HKDF or one of these, preferably not using the same hash function as the one used to derive the $K_j$.

Another: if the adversary can only test a candidate key $K_j$ at relatively high cost $C_0$, and in some conceivable uses of $K_j$ like encryption of a known constant block, an adversary trying brute force and for which hashing has much cheapest cost $C_1$ gains an enormous speed boost from how the $K_j$ are derived; something like $\mathcal O(\min(n,C_0/C_1))$, neglecting cost of a memory fetch per hash. That can be solved by using, in order to derive $K_{j+1}$ from $K_j$, instead of a hash, a slow key-stretching function, such as scrypt or the lesser PBKDF2, with cost parameter(s) such that $C_1\approx C_0$.

Last one that immediately comes to my mind: the receiver must forget the current $K_j$ only after validating the next one, or some later one if lost messages are part of the assumptions. And in the later case it is probably a good idea to limit the number of consecutive messages that can be skipped, else there is a trivial Denial of Service Attack.