JWTs validated against the public component of asymmetrical keys (ECDSA or RSA) can work if you want something that is client-side only and where the license ke

JWTs validated against the public component of asymmetrical keys (ECDSA or RSA) can work if you want something that is client-side only and where the license key contains all information about the license without having to look it up in a remote database. It won’t be particularly tamper resistant, but it should be sufficient to ‘keep the honest honest’ and (IANAL) might help your case in court if need be. Arguably, you can spend millions and still be in that position — though probably having managed to make a more customer hostile solution without significantly bothering those looking to circumvent your DRM.