Yes, I was surprised there would be enough to go on with the MAC addresses rotating and I had assumed the UUID would too, but it sounds like there's enough to go on to identify targets.
Impressive stuff but it would be polite to the potentially interested users if the line, "... this package is currently a proof of concept with limited direct use", had been put a little earlier. It's about nine or so dense paragraphs in.
It's fine that it is still in development but it just seems worth being upfront.
I didn't realise but by chance i bumped into this last night. I wanted to remove a few letters from the Star Wars logo and it refused... Thought it was a bit much, but it mentioned third party concerns.
It spreads the effort for maintaining the list of trusted people, which is helpful. However I still see a potential firehose of randoms requesting to be vouched for. Various ways one might manage that, perhaps even some modest effort preceding step that would demonstrate understanding of the project / willingness to help, such as A/B triaging of several pairs of issues, kind of like a directed, project relevant CAPTCHA?
If you come up with a realistic language spec and wait maybe six months, by then it'll probably be approach being cheap enough that you could test the scenario yourself!
reply