mTLS and apple/google/other-idp signed short-lived client certs would acheive the same thing in my opinion. Bypass captcha if the client has a cert issued by a trusted idp.