Password confirm element generates accessibility-failure markup

I have had the following issue reported to me by our accessibility testers, from the user edit / change password form (i.e. /user/uid/edit?pass-reset-token=...):

(label for="edit-pass[pass1]") is not explicitly associated properly with (input id="edit-pass-pass1" ...) as for/id attribute values do not match.

Also true for (label for="edit-pass[pass2]") / (input id="edit-pass-pass2"...)

(where those (elements) are really html with angle brackets, but that got swallowed by the system)

I've tracked the generated form elements down to the following bit of code:

https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Render%21...

which clearly 'intends' to nest the two password fields i.e. $element['pass1'], $element['pass2'].

presumably the code which renders this into inputs and labels differs, in that the bit doing inputs replaces pass[pass1] with pass-pass1 whereas the bit doing labels does not. apologies I have not tracked things down quite that far yet, I will update if I manage to