I think distributing the work of verifying new accounts as non-spammers to over all existing users is the only way a social network can grow without losing to the spammers or overloading their human moderators, so I like your idea.
But how do you solve the problem of people wanting to join who have no existing contacts in the network to invite them? Most likely they would use some other channel to request an invitation from a stranger and hope that they'll grant them access.
If that happens, then it dilutes the power of the web of trust. A spammer could manually create a bunch of accounts in the same way, and then use them to grow botnets at the edges of the web of trust. If only a few bots are used to spread spam, it would take a while to accurately determine which part of the network is controlled by the spammer.
But spamming has no power in this system. You can collect a huge list of addresses, but as soon as you abuse them once they would be revoked. One-time spamming isn't a viable business strategy.
The bootstrap problem is indeed challenging with this approach. Normally you could connect with people you know in real life using an NFC or QR code exchange, but social networks have created an expectation of being able to find people by searching an open directory. That's a spammers dream. As soon as you can send a friend request that's just reintroducing open addressing.
I haven't spent much time thinking about this since I rarely use social media, but my first thought is that you voluntarily join some groups and find people that way, ie. High school groups, etc. Perhaps friend recommendations by randomly asking existing members could be used to very the validity of newcomers.
But how do you solve the problem of people wanting to join who have no existing contacts in the network to invite them? Most likely they would use some other channel to request an invitation from a stranger and hope that they'll grant them access.
If that happens, then it dilutes the power of the web of trust. A spammer could manually create a bunch of accounts in the same way, and then use them to grow botnets at the edges of the web of trust. If only a few bots are used to spread spam, it would take a while to accurately determine which part of the network is controlled by the spammer.