Existing proposal already imposes an upper-bound rate limit...

It is possible for an entity (or entities) to cooperate across hosts and acquire up to 15 topics per epoch for the same user in the first week.

Is the intent to explore how to reduce "15 topics per epoch" even further? What are some example scenarios?

One option would be to require each calling domain to obtain a signature from a known organization, and maintain a public repository of signers and their policies for any key shipped with the browser. If a caller violates the policy and uses Topics API for malicious or non-ad purposes, any keys used to sign it could be dropped from the browser. (This is based on the First-Party Sets proposal) (#87)