Doesn’t really make sense, because any service can just say “you must paste your human-attestation JWT here to use this service” and plenty of people will.

You can just decay your trust level based on the `iat` value. That way people will need to keep buying me coffee. I can optionally chide them for giving out their token.

If you're engaging with the idea seriously, I suppose we'd need to build a reputation or trust network or something.

Although if you're talking about replay attacks specifically, there are other crypto based solutions for that.