So roll your eyes and use PBKDF2 with SHA2. Regulators have a job and auditors are not intended to evaluate everyone's hand-rolled crypto (obviously a bit if a

So roll your eyes and use PBKDF2 with SHA2. Regulators have a job and auditors are not intended to evaluate everyone's hand-rolled crypto (obviously a bit if an exaggeration calling bcrypt hand-rolled...).