This happens to be a very simple, if not to say naive version of part of how Denuvo works. Although no one seems to know how exactly, it turns out you don't need to understand the egg to crack it.
There are at least a few vulnerabilities in your proposed solution:
The end user is responsible for deciding what serial number they want to send to the server.
Unless the encryption/decryption module is well-protected, the private key is easily extracted. Extracting it from a well-protected module is more difficult, but positively doable.
The software is decrypted.
All the while, it imposes a massive burden on the users, which makes the software more difficult to sell:
- It only works with hardware made to your specifications.
- Every piece of hardware has to be registered on your servers.
- It requires a unique copy of the software to be completely downloaded by every user.
If your solution is meant to be an actual embedded system, piracy isn't a problem to begin with. Copying the entire system is too much effort, unless it's useful for other purposes. You just sell the complete hardware and software package.
If it's truly worth copying, decapping a chip is not rocket science, the key will be downloaded, and the chip itself will be copied, maybe even complete with your copy protection solution.
If it's meant for a general market, that market becomes at least tens of thousands times larger by supporting hardware other than your own custom chip, so even with an unrealistic 99% piracy rate universal hardware support wins in profitability.