The intention is to say "don't build authentication systems unless you really, really need them" and then "if you do build an authentication system make sure it follows sensible practices for credentials".

I don't have time to rewrite this just now but I'd welcome patches!