`passlib` is used in compliance monitor. It doesn't seem to keep up with `bcrypt` -- see <https://github.com/pyca/bcrypt/issues/684#issuecomment-1902590553> Maybe we can use `bcrypt` directly?