Not a huge fan of offline-attackable password hashes in datastores. I want to put a vote in here for an anchoring. Lots of methods: 1) Code secret. This is ok

Not a huge fan of offline-attackable password hashes in datastores. I want to put a vote in here for an anchoring. Lots of methods: 1) Code secret. This is ok but loses all strength if disclosed. 2) KMS wrapping of hashes. This is better; attacker needs to be in your environment, actively unwrapping all your stuff. 3) Controlled hashing step (best). Have one step of your password hashing incorporate a one-way operation using a "normally non-extractable" hardware secret. This could be in CloudHSM if you're in AWS. This completely prevents offline attacks unless the attacker compromises your HSM. 4) It would be nice if cloud providers implemented "password hashing as a service". They could easily and cheaply prevent offline attacks. 5) Of course strong key auth instead of passwords for clients would be nicer.