In theory, yes, and ideally any of this would be implemented as a standard, for instance as a segment of a TLS ClientHello added by a forwarding proxy (such as

In theory, yes, and ideally any of this would be implemented as a standard, for instance as a segment of a TLS ClientHello added by a forwarding proxy (such as Private Relay) that includes a UUID connection identifier, a risk category for the user, the identity of the proxy, and the proxy's signature for the whole of the ClientHello packet. There would then also be presumably a way to interrogate a proxy for reporting back bad actions of a user by a service provider, with those attestations also signed by the service provider. (FLAGGED_AS_BOT, CHILD_PORN_TAKEDOWN, FINANCIAL_FRAUD, SPAMMING, OTHER_TOS_VIOLATION, etc) The service provider would pass in the UUID connection identifier which the proxy could then map back to the known user, weighted by the degree to which the proxy trusts the service provider's reports.