A UUID would work fine. Every product gets a UUID and it goes into a public DB hosted by the manufacturer (or a 3rd party that verifies who is publishing the data).
Then anyone can query against that database to verify if a product is legitimate.
Then anyone can query against that database to verify if a product is legitimate.
At the end of the day... we know these things get leaked anyway...