I feel like this is an underrated idea. Resonates with the whole thing of making a subset of the internet simpler and just like documents, as with the simpler protocols like Gemini etc.
If we then add a few conditions: "no links in the root message" and "OP may not be the first to comment within some unspecified amount of time," that could make it even easier to limit CSAM.
You're right. I thought of another idea: use karma to decide who can post links, images and/or videos. 50 general karma for links, 100 for pictures, you get the idea.
Not an effective solution for a federated service. Just spin up a new instance and give yourself karma. Shoot, there is no centralized service for validating accounts, so just set up 50 alts across 50 instances.