A counterfeiter could simply duplicate a valid proper key. This is an exact analogue for client-side validation, which doesn't work in the presence of active m

A counterfeiter could simply duplicate a valid proper key. This is an exact analogue for client-side validation, which doesn't work in the presence of active malicious counterfeiters.