Huge influx of spam signups

Some previous discussion here:

Perhaps what we really need is a way to put a captcha in the flow somewhere. (Hopefully opt in.) It’s not particularly hard to get an integrity token programmatically (I do it!), unfortunately.