A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct.
It achieves this by embedding the public key in the same Java software.
Legit license information is generated, and then signed with the private key, and is saved to a file, which can be verified by the public key.
Along comes a hacker, who generates his own private/public key pair, and changes the embedded public key in the Java software to his own. He then generates a license file with his own private key.
How can this scenario be circumvented? That is, what measures can the vendor take in order to prevent the hacker from doing the above?