Idea

How does encryption prevent the downloaded encrypted plane being distributed by customers ?

My understanding is :
The MS-Store works by encrypting product, that can then only be run (& decrypted) when in the Officail folder, where it is checked to be owned by signed in user, through the MS_Store sold product database.

So, as well as the encryption service, MS would also have to include an ongoing, Verification service ?

you would still need a link between MS Account and the outside store. If you only encrypt the file and it is not linked to a accound, every user could just run it.

You're asking for something you could just build yourself. A better thing to ask for would be to take advantage of how the store works for outside sales also. i.e. Give customer entitlement and then they can install and update through content manager the same as if they purchased on the store.