AppWorld will query your web service to obtain a registration key.
I don't understand issue of "valid site" vs. "invalid site" - we don't care where you got the app, because our DRM is provided by the servers.
BTW, if you *really* want the straight stuff on this issue, why don't you take your question over to the Blackberry Appworld forum??
BlackBerry App Worldâxxx8222;˘ Development - BlackBerry Support Community Forums
And I stand by my original post: app security is only as good as *your* DRM, AppWorld will not police this for you, they will only implement your policy (within the limits of their system).