>3) if you use a date() to determine a trial period, it's not enough to add (say) 30 days from first use, as a customer may advance the system clock by a couple of years before installing, then enjoy years of free trial after the system date is corrected. You need a "phone home" mechanism that hits your website or other source for an encrypted date response. It has to be encrypted because it's also easy to redirect unencrypted GETs for years of free trial. People often say their customers would never do this, but an ounce of prevention is worth a pound of cure as Benjamin Franklin once observed!

One problem with the ":phone home" scheme is that such behavior is likely to set off alarm bells.