added proposal to caveat the server-side registration warning

[stef]

draft proposal to settle #434

[kevinlewi]

I'm hoping to cut down on the wording and avoid referencing corporate deployments. How about the following suggested text, instead?

Some applications may require learning the client's password for enforcing password
rules. Doing so invalidates this important security property of OPAQUE and is
NOT RECOMMENDED, unless it is not possible for applications to move such checks
to the client. Note that limited checks at the server are possible to implement, e.g.,
detecting repeated passwords upon re-registrations or password change.

Note that the delta is that we are caveating the "NOT RECOMMENDED", with the phrasing "unless it is not possible for applications to move such checks to the client" without elaborating the different scenarios where that might not be possible. I hope this still captures what you are aiming for!

@stef ^

[kevinlewi]

Marking as request changes for the above comment ^

[kevinlewi]

LGTM, thank you!

But I also want to make sure that @chris-wood and @bytemare get a chance to see this before merging.