You can do that the exact same way ez.no allows you to buy and download Online Editor. After you buy it, access for downloading is granted for 30 min, then a workflow "unpublishes" the access.
But what happens if the user has no internet access in that 30 mins, for example because his pc crashes, or likelier because his provider has a problem?
I like the way, for example, how allofmp3.com handles it.
After buying a file you see a download link in the user menu. After the download has finished, the link disappears. I think that could be achieved by creating a new contentobject with an hash as name (so that download link never has the same url), and deleting it again after the user has finished with downloading.
The only thing i dont know is how to decide when the user has downloaded the file?