Why don't open systems offer open sign-in?

Because a free identifier lets bots in as easily as people.

An open protocol lets anyone make an identifier. A Nostr key is a key pair made on a device, and a self-issued credential in SSI rests on the same idea. That is the point of being open: no one has to be asked. It also means one script can make as many as it likes, for nothing. A service that accepts those identifiers at sign-in accepts the bots that come with them.

So a service with something worth protecting usually reaches for a sign-in it can trust: Google, Apple or Microsoft. That is a reasonable choice. Those providers put a great deal into good Sybil protection, and people use them because they are convenient and carry much of the bot problem. In effect they run admission for the service, even though nobody calls it that.

An open system can't lean on that without giving up what made it open. The provider decides who has an account and can take it back. A relay or a small server can't run a detection team, and a phone-number check shuts out real people and tells the service more than it needs. So the open door closes, or it stays open and floods. Why do bots win?

The other place to act is the identifier itself. If making one costs memory held over real time, anyone can still make one with no office to ask, but each new one carries that cost, and anyone can check it without the maker's key. Issued, listed, or made? Each service then decides by its own policy what to accept. Can you check a stranger without asking anyone?

The claim is not that bots go away. The design aims to give bulk making no discount; how that holds at scale is still being measured. It puts a cost on each new identifier, so the open door can stay open.