> But it'll be slower, more expensive, and less transnational etc That's the issue with your idea though. For the current status quo all I need is a valid cred

> But it'll be slower, more expensive, and less transnational etc That's the issue with your idea though. For the current status quo all I need is a valid credit card and the ability to type "curl -H "hibp-api-key: <whatever the key is>" https://haveibeenpwned.com/api/v3/breachedaccount/test@example.com" https://haveibeenpwned.com/api/v3/breachedaccount/test@examp... I can have that done in less then 60 seconds, it fits his threat model, and can be done in any language with a tcp lib. Your idea isn't bad, it just does not fit the problem.