The license server has the private key, so the client (public key) can decrypt but not encrypt license data. This makes it difficult to spoof, as only the license server can sign messages, and there is no need to encrypt the public key, it's the public key. You can't simply spoof the license server and generate new keys because there is also a shared secret that is embedded in your code, that you would ideally encode before distribution.