Doesn't this already exist in the form of ActivityPub? Whether you're using Mastodon, Pleroma, WriteFreely, etc., you can interact with instances that use that protocol.
There's no way Jack doesn't know this already exists.
That paper is from 2018. I expect they've been remediated by now, though everything is going to be vulnerable at some point in some way. What matters is for how long.