It's legal to use cookies for behaviour such as login which is necessary but you need consent for tracking.
If a browser blocked all cookies until the user turned them on you'd have the choice of "no login" or "login works, but so does all the tracking".
Not saying the current state of affairs is good, it's awful.
That way, each cookie could describe itself as login, tracking, optional functionality etc.
You can then penalise on cookies that purposefully violate this, and allow the user to centrally opt in or out of each type.
I see you've covered that with penalising sites who mislabel. Who maintains this list? If it's the browser vendor remember which company owns the largest share in this market.
Otherwise have a way for the web site to trigger a browser-controled consent UI. This would be a one-shot thing and clicking "no" would trigger a spam signal. Too many of these and the web site loses its "ask for cookies" permission.
Cookies for anything not trusted have a lifetime of "until the tab is closed".
Don't be too rough on them. You should look for a viable and sustainable solution, not a radical GtFO doomed to end here.
> Cookies for anything not trusted have a lifetime of "until the tab is closed".
"until the tab is closed" policy isn't convenient even for the user. I tried it and reverted to "until the browser is closed" quickly.