additionally for passwords that are already stored, it's not too costly to check the hashes against the blacklist and revoke those existing passwords.