@GossiTheDog

has a CAPTCHA on signup, not to signin.

I'm sure there is a fork somewhere with captchas to sign in. So the mysterious "they" of Mastodon development have already done the work. It just needs to be spread around.