tl;dr: The author advocates for signing authentication data in the database. Even if an attacker gains write access to the DB and manipulates the auth data, the app can recognize this and prevent access.

I'd rather invest time in writing a proper DB abstraction layer for new systems or audit all parts where the DB is accessed in an existing system than implement the suggested measure.

Great post. Anyone who talks, and actually implements, client key rotation gets a +1 from me.

Far too many systems don’t have a zero downtime key rotation.

Or just salt the string with the username before hashing.

RBAC and proper prepared statements completely defeat all these scenarios.