HMAC Secure Key Exchange?
How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?


The answers to those questions are beyond the scope of the RFC. So, it depends on the context in which HMAC is being used. The keys can be agreed upon/distributed in any secure manner. The RFC doesn't care. It could be via asymmetric crypto, it could be in person, it could be via carrier pigeon (if that is considered secure in your threat model).