That's just making the user need _more_ passwords, and will result in bad password mangement and lost access. Also pins are quite a bit easier to shoulder surf, so this is just nuts.