Binding a bought profile to a single device would be a loss of comfort in relation to the possibility to take your personal KPA backup with you and use it on any other KPA.
As I mentioned before. The Vendor can not make a copy protection. It must be supported by Kemper.
A copy can only be made with a registered KPA and can only run on a registered KPA.
Your Idea with a watermark could help to find and warn from pirate copies. A 100% protection can never be made