The `--` there was originally intended to disable processing of options
and thus protect against situation where password starts with dash. It
turns out that python processes arguments in such a way that anything
after command specification is automatically considered as argument and
not as option for python interpreter.

This also sets it to explicitly call Python3 compared to python as that
might call Python 2 that is not in package's dependencies and thus the
code might break if it would be called with it.