remote authentication for automatic updates

I currently use membership to allow access to theme and plugin files through my site. I’d like to offer my users automatic updates, but I don’t want anyone who gets ahold of the theme or plugin to get automatic updates.

Ideally, I’d like to be able to have this work similar to the WPMU DEV dashboard plugin. Each user will get an API key, this key will be used in a remote call to authenticate their subscription before allowing the automatic update to proceed.

This is something I definitely want to implement sooner or later, but I’d appreciate hearing if anyone else has done this. Or if you could point me in the right direction and give me a bit of a head start in coding it myself.