That's where covert and indirect methods are so useful.

You can hide information in anything - Tweets, Amazon feedback, EBay bids, blog comments, lolcat pics, videos, porn, banner ads, the time a given IP address reloads a web page.

Etc.

You don't even have to use steganography. Like email, it just happens to be convenient.

As long as you can agree a code, you can exchange your key using pretty much any traffic on the Internet.

For any common purpose key delivery is trivial. This is the electronic era - there is no reason not to make the pad very large, and at some point in time you are very, very likely to have met anyone you wish to communicate securely with in meat-space. Ebanking? pick it up when you set up your account. Corporate networks? HR can hand it over when you are hired/promoted. It isnt like you have to constantly get new keys! A single memory stick pair will cover all your traffic needs for life.. or at least until you forget to take it out of your pockets before washing.