As to altering MS-DOS executables, the only option that I see that someone cannot go through is a dongle with the MD5 image signed by your public key burned on the ROM. The dongle will be optional, and for user verification that the program works. I wonder if one can boot off the dongle... have it do its tests in rom on applications....?