>I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system.

After years and years of looking, a problem for which cryptocurrency is the perfect solution has been found.

Oh wait, Hashcash is kind of how we got cryptocurrency in the first place.

But yes, let's pretend that much less creepy forms of attestation aren't a solved problem and figure out how we can introduce more avenues for surveillance.