Well, what I thought (or maybe someone else said and I just adapted) was having an external, independent skin host (or just somewhere on phpVMS/VACentral) and API keys for users, then all skins are delivered from that site. That way, free skins can be uploaded (and properly managed to remove ones which don't work or are no longer supported) and licensed to everyone, and skins can be uploaded by the designers/whoever to be licensed for a single user. If someone tries to use a skin they're not licensed to, they'll just get a lovely big warning all over their airline.
Not really put a lot of thought into how it'd work though.