Small section about how Spam should be handled somehow by a server. Sigh. How about we build a federated spam/harassment prevention system first? I have little hope that a spec not designed to reduce/stop harassment up front can have it bolted on later successfully.
Vouch is a pretty clever scheme — as the sender, you include a link to someone who linked to you, who the receiver also linked to. So your server can detect, essentially, "randos" — unknown sites that might be spam, harassment, or good replies from someone who found your site accidentally.
I haven't yet implemented Vouch in my server software https://github.com/myfreeweb/sweetroll but my idea is to eventually have a settings switch that determines what to do with mentions from randos — reject, require pre-moderation or accept. Depending on your situation you'll be able to change it — e.g. set it to pre-moderation when some spam appears, or set to reject when a harassment campaign attacks you.