well ... but ... put a passwords.txt file on a https webserver and secure it with .htpasswd ? It seems that all systems either do something as weak as this, or use a provable secure mechanism, which has a higher barrier to entry.