You suggestion prompted some reconsideration of the design. I think we can address your concerns and put us closer to implementing password policy in other authentication handlers with some modifications. I'll experiment on another branch and follow up with a link.