There's a pattern you can watch happen on any reasonably popular site once a quarter. A team ships a new sign-up flow. They add reCAPTCHA. The bots keep coming. They upgrade to reCAPTCHA v3 invisible. The bots keep coming. They switch to hCaptcha for privacy reasons. The bots keep coming. They try Cloudflare Turnstile. The bots keep coming. Somewhere around month four, somebody writes a Slack message that reads "what if we just made it harder for real users ?" This is not a story about a par...