I'm curious: If the regulators required SHA-2 hashes, and the author desired blowfish, why couldn't they implement blowfish+SHA-2? I.e. sha2(cost(blowfish(passw

I'm curious: If the regulators required SHA-2 hashes, and the author desired blowfish, why couldn't they implement blowfish+SHA-2? I.e. sha2(cost(blowfish(password, salt), cost_factor))