"Signing" with public key
Actually, if everyone uses a different salt whenever they "sign", and if the RSA_sign operation doesn't involve a hash (in general, real signature operations do, I don't know about your variant), it turns out not to be secure, and in fact, the password can be recovered fairly easily if the attacker hears enough signatures based on the same password.

Here's how it works: when someone signs the password, what they effectively do is take their password, apply the PKCS #1.5 padding to it, forming a message $M$.  Then, they select a salt $A_i$, compute the 'signature' $S_i = (M + kA_i)^e \bmod N$, and publish the pair $A_i, S_i$ (where the value of $k$ depends on exactly how you combine the password and the salt; whether it does addition or bitwise concatination; we'll assume that the attacker can guess that).  Now, this may not be the order that the signer actually implements things, but as long as the results are the same, that doesn't matter.

Now, suppose the attacker can get $e$ different such pairs $(A_i, S_i)$, and he wants to recover the common $M$ value.  What he can do is binomially expand each such pair as:

$M^e + \binom{e}{1}kS_iM^{e-1} + \binom{e}{2}k^2S_i^2M^{e-2} + \ldots + \binom{e}{e-1}k^{e-1}S_i^{e-1}M + k^eS_i^e = A_i \mod N$

Now, the attacker knows all the above values except for $M$.  So, he can then treat these equations as $e$ linear equations in the $e$ variables $M^e, M^{e-1}, \ldots, M$ within the ring $\mathbb{Z}/N$, and find the solution for $M$, recovering the password.

Now, there are several obvious ways to break up this attack:


Use a huge public exponent $e$
Combine the password and the salt in a nonlinear way (for example, by hashing them together)


On the other hand, the existence of this attack demonstrates that you really should think twice before trying it.