Build a tree, cut the tree at the first link, now you get rid of all of them. Will have some collateral damage though, but maybe safe to assume actually "good players" can rejoin at another maybe more stable leaf

It's a web, not a tree... so this is really not that simple.

Yeah, that's the problem, and my suggestion is to change it from a web to a tree instead, to solve that issue.

That does not work because you won't have multiple parties vouching for a new entrant. That's the whole reason a web was chosen instead of a tree in the first place. Trees are super fragile in comparison, bad actors would have a much bigger chance of going undetected in a tree like arrangement.

What is a web if not multiple trees that have interconnected branches? :)

In the end, it's all lists anyways :)

Well - lists of tuples. Otherwise knows as a graph :)

Then I can see who added that bad player and cut off everyone who trusted them (or decrease the trust level if the system allows that).

Trust in the real world is not immutable. It is constantly re-evaluated. So the Web of Trust concept should do this as well.

Also, there needs to be some significant consequence to people who are bad actors and, transitively, to people who trust bad actors.

The hardest part isn’t figuring out how to cut off the low quality nodes. It’s how to incentivize people to join a network where the consequences are so high that you really won’t want to violate trust. It can’t simply be a free account that only requires an a verifiable email address. It will have to require a significant investment in verifying real world identity, preventing multiple accounts, reducing account hijackings, etc. those are all expensive and high friction.

I really don't want to expand the surveillance state...

Are GPG signing parties part of the “surveillance state”?

It is the exact thing this system needs

aka clown explosion