The first issue you bring up would be resolved with the idea of separating identity and authentication as separate providers from instance providers. In fact, it’s much better than just relying on a small difficulty, as that is more likely to discourage a well meaning non-technical person than a malicious actor.

Wktn separate identity providers, your instance can trust the identity providers that have good reputation. And if I want to be seen by your instance, then I have to have one of those identity providers approve me.

Different identity providers will have different standards and requirements.