Or instead of changing out of the blue what exists today and is probably soaked into whole following ecosystem around the product and would be massive PITA to c

Or instead of changing out of the blue what exists today and is probably soaked into whole following ecosystem around the product and would be massive PITA to change it as well, you could have create parallel way for login (i.e. via certificate) and tell customer that password access will be deprecated in 1-2 years, so they have time to update their tooling.