> But it's a necessary evil for a _distributed_ currency.
Bitcoin is an equity based currency. If you have some Bitcoin you "own" it much like you would own a physical thing, like a lump of gold. And indeed, you are right, to implement a permissionless equity based currency, you probably need something like proof of work to ensure that there is an objective ordering of transactions.
However....! You can also build a credit based currency, whereby anyone can issue IOUs which are agreements between a debtor and a creditor. In this regard you don't "own" an IOU but you are a participant in an agreement which is an IOU. That might be pedantic but it's a difference from an equity based money system. For a credit based system you don't need proof of work or an objective ordering of transactions as any transaction is just a bilateral agreement between two parties. You could make the IOUs bearer instruments by introducing some blockchain elements (unilateral ledger updates) but ultimately there isn't much point in this because you have to trust the issuer. The difficulty with this type of system is that it's tough to bootstrap it - how do you measure reputation in such a system? How do you determine who's credit is good and who's credit is bad?
I think it would be exciting to see more research into distributed credit based monetary systems. Interestingly, our current monetary system is basically a pure credit system and that in this system we can view different types of credit as having a position in a money hierarchy. At the top you have central bank credit, next bank credit, next company credit, next credit issued by individuals. When an issuer's credit can be trusted enough such that people can use it as a medium of exchange (it can be endorsed from one party to another) then it _becomes_ money. That's quite cool. You can build a whole distributed monetary system from an endogenous money supply!