To validate updates using asymmetric crypto you don't need to buy a special key at all. You can generate the keypair yourself... The only thing you need is some

To validate updates using asymmetric crypto you don't need to buy a special key at all. You can generate the keypair yourself... The only thing you need is some crypto lib to check a RSA or DSA signature on the downloaded data using a public key embedded in the software.