Blacklisting would soon force him to get hundreds or thousands of signatures, which would slow down the operation.

This said, i don't think "trusted authorities" are the way to go - we've seen the failure of that model with x.509, there is no need to repeat it elsewhere.

Presumably a service would only allow one (or a few) accounts per actual person. The end user will still need some amount of security. I had in mind some challenge-response mechanism, like:

  Person signs government ID number with public key, presents it to authority
  Authority signs public key and asserts it belongs to a real human
  Service presents random number at signup time
  Person signs the random number with the same public key, and presents the key signed by the authority

I'm not entirely sure how that would mitigate people from passing the government signed public key to their bot and letting it take over from there.

That's what I was referring to with services only allowing one (or N) accounts per person. A spammer could use the signature multiple times, but would need new email providers for every single account.

And as an uncle (?) comment points out, there could possibly be blacklists of signatures of spammers shared between providers. That definitely would cause some new problems, of course, but who knows what the future may hold...

Oh I see. I hope it doesn't ever come to that!

1. Unlike e-mail accounts or such, a botwriter wouldn't be able to get thousands of such signatures to go on as soon as the first one is identified and blocked; if he puts his own key in the bot - bam, you (and everyone else you know) can exclude him from your services permanently, and he wouldn't be able to come back with a fresh account unlinked to that one, ever.

2. The signature is linked to a specific person, so if the private key is stolen, then you (a) revoke it; and (b) punish the thief - because obtaining that signature most likely be treated as a felony, unlike spamming comments or other uses for breaking captcha's.

If multiple signatures from the same key are recognizably the same person, wouldn't this have the unfortunate implication that your identity can be linked across different services? There'd be no way to have multiple email addresses anonymously without being able to trust the provider.

Blacklisting the bad signature as well as being able to trace it back to a real person would be pretty significant deterrents.

That seems pretty obvious to me, making me wonder what you're really getting at.