Derive a key from a password and another key? I would like to encrypt some data using a password. I want to use a function like PBKDF2 to turn my password into a key. However, I would like to also require a keyfile, for added security.  My data should only be decryptable if I have the password and the keyfile.

What is the "best" way to do this?

From what I understand, I should not be using the salt for this purpose, correct? I.e. I could use the salt as my "key file", and the password entered by the user as the password, but most literature I can find does not recommend using the salt this way.
So the advantage of the keyfile in addition to the password is that it is basically a form of two factor authentication: You have a password (something you know), and a token (something you have).

The problem is that your salt must be available in order to derive your password based secret, which would mean your token (the salt) is not really separable from your password - this means you don't really have two factor authentication anymore, as the salt can't be separate from the password. So using the salt as the keyfile would not really improve security at all. 

One way to accomplish what you are looking for is to generate your keyfile using /dev/urandom or equivalent to generate an appropriately sized token (128-256 bits). Then keep this keyfile on a USB drive. This way, whenever you need to access your secret, you require both knowledge of your password, and possession of the physical token.

After validating the password and keyfile, you could generate a single master key via something like hash(keyfile || password_derived_secret).