Anyone can generate a public/private key, it’s not linked to a client

Captcha can be broken, unfortunately. I’ve worked at places where we automated processes that would move past Captchas with much ease, in order to scrape websites.

They are just adding that hashtag and their crap shows up. Check #introductions

A better approach to getting people set up might be some kind of invite code that triggers some trust-improving automation. E.g. if I use an invite code, my client publishes a hash of that code, then a "verified introductions" bot tied to that code starts following me. Now my posts show up on a custom feed based on that bots follows.