This doesn't need to be solved via time-based expiry though - you can use a breach list (like checking https://haveibeenpwned.com https://haveibeenpwned.com on

This doesn't need to be solved via time-based expiry though - you can use a breach list (like checking https://haveibeenpwned.com https://haveibeenpwned.com on registration,login, and password change). Even an aggressive password change policy is typically one month since last change, which would give a long window for access. Secondary factors, if at no other time then on first use of a machine, are also a good technique to prevent password breaches from spreading into your system.