I do think badges are the perfect solution for this. Verify whatever you want, issued by whomever. One-off pubkeys could also be used to prevent people from correlating badges about a single person. Also, private badges?