I think it's a reasonable approach to consider spam as an authorization issue, and authorization was left to extensions, but generally it could involve oauth2/oidc + dynamic client registration + any policy of allowlisting webmention senders