Comparing passwords to a list of compromised ones doesn't leak anything. Just ignore the user name. And hashing on the client in addition to the server doesn't

Comparing passwords to a list of compromised ones doesn't leak anything. Just ignore the user name. And hashing on the client in addition to the server doesn't save you from any mitm attacks.