In the real world recommendations can be believed since if the person being recommended screws up then it reflects negatively on the recommender. Hence we are careful and recommendations are trustworthy to an extent.

But in this online model, reputations can be built and destroyed on a daily basis with nobody feeling the pinch but the person who’s building and destroying his own reputation – an attractive proposition to spamsters?

I think an implementation of your proposal which has some cost to the recommenders would be trustworthy, that is, a model that keeps track of how trustworthy a community is (maybe a count of how few of its recommendations have destroyed their reputation?).

this seems like it could apply to the scenario you describe, because the opaque data can just as easily represent reputation as anything else, and the entities in the chain can be collective or singular. i.e. when the home community gets a message from the foreign community saying “your entity #12345 misbehaved,” it can weigh its relationship with #12345 against its relationship with the foreign community, and act accordingly.

just like real life, any time a party shares (e.g.) its identity with another party it runs the risk of that party sharing it with another party. but an arbitrary inquiry can’t resolve the identity associated with a particular token unless it first establishes a trust relationship with at least one of the parties which already knows that identity. meanwhile, #12345 retains the option of never sharing its “identity” data with any other nodes, which forces any party wishing to resolve that token to contact #12345 directly.

I don’t know whether anybody’s actually using that model…