> there would be nothing stopping them writing their own glowing references.

Verification wouldn't be trivial, but a Trusted Human, could check that both their CS and their import match, at a glance - or the public profile could be extracted to partially automate the process.