Abuse would be tricky, you might be able to limit it by letting only a few DDoS mitigation providers populate the list.
This particular DDoS I actually believe is _not_ due to a botnet, or at least believe there is insufficient evidence either way. The attack appears to be using a technique/infrastructure I’ve been passively tracking for nearly a year, wherein the attack DNS requests are spoofed to appear from seemingly-random clients and sent to open recursive DNS servers across the Internet. This makes the attack look like a botnet to superficial analysis on the target side, but this isn’t necessarily the case. In the small amount of time I’ve so-far invested in trying to track down the origin, I have yet to observe generation of the initial query packets.
Unfortunately this is already in use with some malicious ads as well as phone scams to get people to give remote access to overseas tech centers that then scam them into paying good money for nothing.
To date the only tech line about this is, "nobody legitimate will ever contact you to tell you you're infected with a virus."
So I don't know how you could develop trust in that environment.
Other people share a network behind a NATed IP which is also a problem. They'd all receive a banner, check their computer and a test would come up negative.
No thanks.