This is in conjunction to 2FA, for contexts that don't support a changing password. Given an array of hashes, the user can authenticate with any of them.