My new antispam thesis is this:
1. Reject events unless we already have a kind 0 (profile event) for the pubkey.
2. Restrict making a kind 0.
By requiring profile events, you force the attacker to ...
How do you globally restrict creation of a kind 0, or do you require it has to be created on your relay? Don't see this being a good strategy.