There's no effectively using private/public keys whatsoever. The communication with the server must be secure, the extra hash only provides the ability for the

There's no effectively using private/public keys whatsoever. The communication with the server must be secure, the extra hash only provides the ability for the server's data getting leaked without compromising the password through server logs. The usual setup I'd say is to salt the password in the server and store (salt, hash(pw+salt)), but that still handles text-plain password that might get logged by mistake.