> (And also clients still need the plaintext password at least client-side no matter what we do)

Are matrix devs seriously not aware of what OAuth is and does? That is ... concerning.