Given a salted hash is being encrypted, who needs a nonce? The salt's already taken care of that, right?

Also, if you have 4 billion hashes stored, and you rotate the key, and you still have 4 billion hashes stored... What's changed? You would need a key ring or derivative keys I guess but I think this is actually a case where ECB does the job.

But I guess we've now proven the point that even a pepper is non-trivial.