Yep signed tweets solve this and it doesn’t need to be perfect, it can even be partially automanaged by Twitter infrastructure just to restrict staff.