I thought through this a while back and it would be too big of an opsec risk. You certainly could make it invitation only, but in the process that makes the pool too small to be useful. I DO think it makes sense to have it be a thing on existing sites because you can already have an idea of who the person is and have some type of site group culture to use as a filter, if that makes sense.