To add to that I would also tie the encrypted key to a maximum reccount() to a primary table so that any successful bypassing of your expiration date would still be limited by the maximum reccount().