That scheme avoids storing anything useful in any single server, and requires an exchange with multiple servers to piece together the credential. This is interesting, but requires interaction with multiple servers, which is a performance and availability problem, and may have intellectual property issues, and I think the sacred WG decided it really isn't important enough an advantage to worry about at this time. I was talking to someone who was concerned about having the server send you your credential without authenticating you. The credential is encrypted with a strong secret established in the client-server exchange that only can be known by someone that knew your password.
Someone impersonating the client can only test one password at a time in an on-line, auditable way.
It is auditable because the server has to participate in a protocol for each password guess. I think it might be the easiest to understand. The client has to actually know W in order to do this protocol. They also store something with which to parameterize a Diffie-Hellman exchange and come up with a strong secret, which will be used to encrypt Y and send it to the client. Hope this is intelligible.