Make identity creation quadratically expensive inside a cohort. A new agent must solve an issuance puzzle, a delay function seeded through a threshold cipher from its cohort tag (AS number and epoch), and the difficulty scales with the square of how many identities that cohort already minted: ten puppets cost a hundred units of compute, a thousand cost a million. The signing root is bound to the device kernel and cannot be cloned off it, so a seized machine is a spent relic, not an endless factory. Attackers pay superlinear compute and hardware churn; honest newcomers still join cheaply.