I think the idea that only registered users of the WhdLoad tool should be able to download the installs is good.
The only question is how to manage this?
Heres a suggestion:
All files have to be located on a ftp where only registered whdload user have access. The problem is to get to know whos registered to whdload and whos not... Perhaps Wepl could help here.