I think it’s just for enterprise contracts, yeah.
Fedora seems like a good general-purpose pick to me, because it is modern, it has a large community, and it’s easy enough to install and use. It has similar advantages as Ubuntu — that is, a large community and broad commercial third-party support — without the downsides of having a lot of outdated software and lacking support for new hardware. I think Fedora is less likely to have show-stopping limitations than a lot of other distros, even beginner-friendly ones like Mint.
But that’s just one opinion. There’s nothing wrong with Ubuntu or derivatives. I’ve heard good things about Pop_OS as well, though I’ve never tried it myself.
This assumes a legitimate need to prove who you are outside the context of that specific site, rather than just within it. Sometimes that need is real, sometimes it is not.
When it’s not, and you only need to prove you are the same person who created the account, then a simple username and password is sufficient. Use 2FA (via authenticator app or key, NOT via SMS or email) on top of that. This allows users to prove to a sufficient degree that they are the owner of that account.
This is how most Lemmy instances work, for example. I can sign up by creating a username and password, with optional 2FA. They do not need my email. They do not need my phone number. They do not need my name, or my contacts, or anything else that is not related to my identity within their server.
I realize that this is untenable at large scales for any communications platform. Spam (and worse) is a problem wherever there are easy and anonymous signups. I’m honestly not sure how Lemmy is as clean as it is. I guess it’s just not popular enough to attract spammers.