What if the hash you're sending is discovered? I can use that to login to the service; it offers the same protection as a plain text password.

As the hash is being encrypted with the public key in the client, that would require that the client be compromised. In which case the original password is already exposed at that point, thus a discussion of the transport is no longer the concern.