At the moment all CCP restrictions do to prevent spam is stop comment/post flooding by unpopular users. The sensible alternative is to make rules that directly prevent flooding. You can look through the data and see the frequency distribution of users' daily posts/comments - this is a good reference point. (At the moment low-CCP users are limited based on a 24-hour window, I think moving to a 48 hour window would be less of an inconvenience for genuine users - what follows doesn't depend on the window chosen.) Take for example the 98th (or xth) percentile relative to the frequency distribution above and set this as a global comment/post limit for all established users regardless of CCP score. Nobody can comment/post more than this within the chosen 24/48 hour time period. Apart from this fixed limit, let users post/comment without captchas until they get to say 80% (of whatever you want) of the maximum, introduce captchas for posts/comments from 80-95% of the maximum, double the necessary captchas for 95-100% of the maximum. This should kill flooding by individual accounts while only inconveniencing a few genuine users. Users who regularly hit 100% of their limits despite the apparent inconvenience of captchas would be red flags for administrators to investigate further.

I also consider the ability to upvote/downvote as an important aspect of free-speech, and think they should also be subject to universal limits for established users similar to the above.

In my opinion, discriminating against users who are not 'established' on voat is not an infringement of free speech so long as becoming 'established' has nothing to do with the popularity of users' ideas. Clearly CCP is a terrible measure of a user's patronage or sincerity. I suggest a new measure whereby a user becomes established when they have accrued 50 (or whatever) days when they logged in, voted on something, and commented/posted at least once. This may be overly harsh towards lurkers, so perhaps just logging in and voting is enough, though this has greater 'security' risks for voat regarding establishing the reputation of a user and guarding against some manner of hostile takeover by newbies. I also think such an establishment score should be degraded steadily if a user is inactive for more than two weeks (or whatever). This acts as a measure against sleeper accounts. Something like 25% (or whatever) of established users' commenting/posting/voting limits for newbies might be appropriate.

I don't view the ordering of content via up/downvotes or the mere act of reporting a CCP score as real impediments to free speech, especially when we have the option to order from the 'bottom' as well as the top. This type of user control of how they view content could be expanded: firstly by giving a 'Bottom' ordering for posts that complements 'Top' by swapping the role of up and downvotes. Various 'Middle' type orderings could also be introduced for comments and posts.

I am against increasing moderator powers - most people accept that this path is easily subject to subversion. The ideal is to have the site owners/PuttItOut doing the vast majority of moderation algorithmically.

When it comes to preventing intelligent subversion, CCP restrictions are useless. People or organizations are free to open as many accounts as they like, and many smart professional operators who wish to steer apparent opinions on voat are not dumb enough to draw attention to themselves by posting commenting too frequently from single accounts. CCP restrictions are also easily gamed by saying whatever voat wants to hear, posing no impediment all even to isolated individuals whose goal is subversion. I cannot think of any way at all to counter professional subversion while preserving user anonymity. I see this as an unsolvable problem unrelated to voat upholding free speech for its users.

The exact details of spam rules may reasonably be subject to secrecy. However, I think CCP-restrictions have little to do with spam, and are instead related to free-speech. Whatever rules you decide on regarding user-limits on commenting/posting/voting should be made painfully obvious to all new users, preferably before they open an account.