[deepbreath]

> meaning old hashes wouldn't be accepted and reducing hash "replay" possibilities

How would the server even verify the hash, then?

[pbhjpbhj]

Verify the signature, check the time, use the hash as if it were the password to re-hash and compare with DB?