Attack on key exchange with authentication
No, this scheme isn't secure.

As far as I understand your description you are using the hashed public key of Alice as the symmetric key to a cipher, but as you already just send this hash over the line, the attacker can simply decrypt $k$ himself and thereby $k$ isn't established as a pre-shared key. By the way, there's no way to recover $pk$ from $H(pk)$ and thereby you can't public key encrypt $k$ here.

This can however be fixed in one of two ways: a) you don't hash the public key at all and just let Alice send Bob her public key, which he will subsequently use to asymmetrically encrypt $k$ so only Alice can read it. Or b) you just stay with the hash of the public key (and maybe drop the $k$ which doesn't serve any purpose if the channel is guaranteed to be integrity protecting) and let Alice send her public key over the internet in clear. Bob can verify the public key using the trusted hash of it and if the hash of the received public keys match, he can then use this to encrypt a session key.