@wreiske this is awesome. One more somewhat related thing that should also be interesting for @awatson1978 - did you consider to look at the SHA256 function that is still used in Meteor core in many places (via sha package)?
I kept this private and reported it but nothing happened so I thought you might take a look at it.
Edit: I don’t want to spam / distort your post I just think its a great move to improve the overall security of Meteor and in my opinion that sha256 is also a part of it. If you think this is worth to work on then I will start providing a drop-in replacement for the sha package and PR to core
Edit edit: continue this topic in Accounts improvement initiative - #6 by pwix