Compromised password check (Have I Been Pwned)

On signup and password change, check via Have I Been Pwned's k-anonymity API whether the password is known from a data breach, and reject it if so. No private data transmitted (only a hash prefix).