You only "friend" people in real life who you trust not to act maliciously. If you unwisely trust someone who is malicious, you encounter various problems, just like in real life. But it would be very difficult for a malicious person to construct a realistic-looking subnet of sockpuppets because that would require getting lots of real people to make that unwise decision.

Not saying this is perfect, but I predict that the vast majority of users who "friend" 20+ people irl who also have friends will be fine, and borderline cases will be borderline.

One thing that might be valuable on this is to do sms contact syncing where people can provide soft proof that they share the same social circles. In essence, if both parties have John Doe in their phone as 123-456-7890 , we can extrapolate that they both know him. Extend this across many contacts and it might be possible to see how much their direct networks overlap. One way of proving a person is indeed who they claim to be is by using a service like authillo.com

An invitation model would inherently link bad actors. With that being said, I dislike the approach.