Create an API which can check passwords for strength and security policy compliance, and allow extensions to hook into the check. Note that the API should receive all login data, not just the password (it is common to disallow passwords which are very similar to the username, for example).