> However, your customers also don't want to hear that you were hacked and all their sensitive data is now in someone else's hands. We offer easy-to-use protection from that increasingly common scenario.

Generate an escrow keypair and ask the site owner to provide their own long passphrase for encrypting the private key. If a user needs to reset their password, they can contact the site developers who will need to key in the passphrase temporarily to generate a password reset link.

Yes, this leaves various avenues of attack involving caches and whatnot to get to the private key while it's briefly decrypted, but it's still way more difficult than hacking a MySQL database, which is what you're trying to beat. (And it retains the property that I don't need to run a MySQL database.)