Although it would be a seriously difficult task to reverse engineer a fpga bitstream it has been done and people like xilinx take it seriously enough to offer devices with a built in AES decryption engine which can decrypt an AES encrypted bitstream on the fly.That might be the answer to Lynn's security problem although there is then the problem of key management and generaly devices which have the AES decryptor built in tend to be the larger and more expensive devices.
what we used to do was give away demo versions of our fpga products but we would supply the customer with the edf file and we would use a program which converted everything in the edf file to nand/nor gates and then randomly renamed the signals.We always assumed that would keep them busy for a while.