Maybe a dumb question, but I do know at least a little about the topic: Why not TLS client certificates instead of passwords or passkeys?
If you don’t present the cert you don’t even get to connect. AI scrapers get stopped at the door. Easy to revoke when bad actors get one. Browsers and mature tooling already supports it.