Yup, users aren't capable of making explicit attestations (and don't want that overhead).
Looking at the activity at the community-level is the way.