I'm so surprised to see protocols running airdrops without meaningful sybil protection

With zkPassport protocols like @SelfProtocol, sybils can be squashed with no privacy implications

Just communicate early that you will not be rewarding sybils, and you won't get complaints