I believe the cancellation time has now been extended to 2 hours as of today...
This is hazardous...
Then one solution will be to request a key that can only be obtained by email from developer (after a purchase is made)
in your app you will need to embed a unique identifier for each copy during compilation. Your user must provide you with that identifier. Still they may crack it, but the
way you design the identifier will define the degree of difficulty for the hacker.
The point is: from the time the download is complete, to the time the user receives your key, the two hours will pass. during this time
you can let your user to test the app with limited functionality.