Without going too deep into this issue ...
> The LPC55S28 is emulating a removable EEPROM device called a Datakey.
Can you be sure your emulation is fully correct ? A proper test would be to attach the emulation to a board/code that previously worked fine with the actual device.
> On a previous implementation that emulated the Datakey device using a PIC18 as a slave, I was able to receive the command/address and set the outgoing data for the SPI feature to the data at that address before the next transaction occurred, about 5us later.
While I guess the PIC18 supports SPI transfer sizes above 8 bit (e.g. 16 bit), this is still a 8-bit MCU.
The rest of the description sounds like the transmission logic of the (slave) LPC55S28 does not behave as expected. I must admit I have no experience with LPC55Sxx devices, just assuming the same SPI-IP like on other LPC controllers is used.
What I would do - make scope or logic analyzer recording of all involved lines (Clk, MISO, MOSI, SS) on both slaves (or better, one on an actual 645), and compare both.
One pitfall of SPI is it's high configurability, especially clock polarity and trigger edge. Perhaps there is a mismatch in those settings.