On the relay side, maybe allow nip-42 authenticated users to push gift wraps (where event.pubkey is not the authenticated user).

On the client side you need to process all incoming gift wraps and only check WoT after unwrapping. That adds some spam processing overhead unless you only connect to WoT relays.