That feel pretty much the only way you can easily filter bot out.

The best ID to check would be a government ID or a bank account ID. The gov/bank are absolutely crazy about making sure that someone is really someone.

Unfortunately, this is incompatible with anonymity, unless we trust the instance admin.

I really like the SMS thing.