I am aware of the Orwellian privacy implication, but how do we deal with bots, now that AI is rampant?

Something like hashcash, or what?

Feels like something systemd can solve with a compile time flag. Either have it on or off depending on if you want to legally sell it in those areas or not and away you go.

After all, any and all age checks we have nowadays are a black box anyways

This is the only part I disagree with. Age verification is typically done via services like ID.me, Lexis Nexus, etc which do it via identity verification with documentation. The alternative method that most social sites have gone with is age prediction from a face scan, of which providers are more than happy to tout how they do it as differentiators. For the latter, there are even FOSS options.