1) Don't publicize how you reject passwords (this, obviously, won't work for open source). You can reject with a generic "please choose a different one" or something similar. Just vague enough to not directly show that you're reading off a list of bad passwords.
2) Ignore the patent.
I'm a fan of 2, but fighting a troll alone is most definitely not an option. If I do get sued, perhaps I can contact all other people who were also sued (since trolls tend to fire shotgun lawsuits to see which ones buckle) and fight back together to try and get the patent invalidated.
Meanwhile, I can write to congress (have all the others do the same) and wait for it to have no effect whatsoever since, obviously, we all know that what really kills American jobs is those damn immigrants /sarcasm.