We can check that an incoming modification will not leave an entry with more than one userPassword value. We already have a partial check for this now. But what can we do for an entry that already had multiple values, e.g., created before the overlay was in use? Simply refuse to Bind?