LSAG is a good shout but I’m not sure it’s sufficient. It enables anonymous verification of something against a set of known public keys. But you still need to make sure that set of public keys is coming from real humans. It’s not proof that a user has a property (i.e. being human), it’s just proof they are a user.

But yes this is sort of a digression from the actual main problem. The real anti-bot solution is a mix of methods imo.