3 ms·

Give them a reasonable deadline, and just disable password login afterwards. This isn't something they should have trouble understanding/accepting.