This so far has mainly been looking at distinct Nostr domains - Zapstore, Marketplaces, Git, etc., so spam fortunately hasn’t shown up yet the way it has on the social side. But it certainly will at some point, maybe tomorrow. Spam, fake data, attempts to game the metrics, active attempts to poison the data, etc. There is a lot of mileage in some take on web of trust at that point, but it could be a combination of measures over time. There are some shenanigans already going on with Lightning zaps data, but these have been relatively straightforward to deal with for the most part