The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But i

The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".