gRegoras a proof of concept, my implementation parses a public page I set up for an allowlist. I don't think it would be a big concern if those were advertised somehow, since verifying received vouches is relatively simple. Much simpler than finding the vouch to send.
