What steps would be reasonable to "verify that their customers actually reside in the United States, or own organizations based in the U.S." and wouldn't be very easily subverted by bad actors?

I would object much more strongly to registrars being heavy-handed about verification for .us domains than being overly-loose about it.

Phishing/spam problems aren't going to be solved by verifying .us domains.