Yeah, can't there be a security module that is not open-source that makes some checksums on the client or something? I know it has been discussed before... dunno why noone talks about it anymore. The module itself would have to send the key, encrypted in some way so it cannot be sniffed, that tells the server which version and if the checksum matches. I think some people were saying that they could modify the client to fake the 'OK' signal to the server, but if it needs to actually send an encrypted key, I don't think they could do that. And there could be updates (automatic) every X weeks or months that change the key/encryption method.