At present, most probably only those that appear on the regulatory radar in their own right.

Probably. Regulators usually care about reach, not architecture. If the Fediverse became genuinely mainstream, it would likely end up in the same political spotlight. The real difference is that federation makes compliance an instance by instance problem, not one global switch. That is much harder to enforce.

There probably is no magic solution: I would focus on making abuse expensive instead of making honest users miserable. Gradual trust, optional vouching, sensible rate limits, reputation, and behavioral signals together will outperform almost any CAPTCHA while keeping the door open for real newcomers.

This! It’s fast. It’s reliable. Love it!