Anonymity/Privacy are not inherently universal. Your true identity can be known to some and unknown to others in this case masked via an alias.
Thus, I propose a hypothetical arrangement: separating Content Instances and Identity Instances.
Content Instances host the main communities and discussions. There must still be “many” (hundreds maybe even thousands) of these so that none can wield power of the others.
Within Identity Instances you are known or at least verified and vetted. External to the Identity Instance a user is only known as their alias from the identity instance. There should be many more of these with a maximum user size ~100 (see Dunbar’s number).
Further, federation should not be open by default. New Identity Instances are quarantined initially with the ability to subscribe to communities on Content Instances, but the posts and comments from the Identity Instances are not federated back to the Content Instances.
The goal here is to employ a heavily distributed Divide & Conquer approach to moderation and community management. The users of an Identity Instance are responsible to one another as any of their actions may cause the entire Instance’s users to be affected (i.e. defederation). Even better if you know each other, you should feel some real social pressure that your actions online will impact your social life IRL.
But to be honest and pragmatic, I don’t think this will form organically nor do I think it could be enforced. And even in practice it probably wouldn’t work. But perhaps it’s a nice dream.
I can’t say what it should be. I’d argue that each Content Instance should have it’s own path to becoming trusted. An example could be: demonstrating quality post/comment content during the quarantine period.