RE: Dovecot's default password storage scheme is not GDPR compliant

This is not the point, however.

The point is that the default is not GDPR compliant, and a first easy alternative is also not GDPR compliant, and decoupling the user scheme from the server storage scheme is not at all obvious. Adopting a GDPR- compliant default would send out the information that the project cares about legal compliance, and a solution is supported by default.

A default dovecot (el9 rpm) install is compliant as it does not work and does not do anything, it is just a bunch of binaries on a disk.