If you trust Steam to be secure enough that users can't add games to their account without actually purchasing them (which, let's be honest, if they could, Steam probably has waaay bigger problems than just that), then you could just query their Steam account.
Method 1: OpenID
Upsides: No Steam binaries to bundle. Potentially no need to take the users password yourself (unless they can't be sent to Steams website through a web browser and you need to collect it yourself).
Downsides: Doesn't work for private profiles. Requires a web browser.
For just OpenID logins you can have the user do their login (either on Steams website or through your code) to assert their identity and then run queries to the Steam Web API based on that identity.
According to steamcommunity.com/dev,
Using that SteamID you can query Steam with any of the API endpoints but you'd specifically want to call GetOwnedGames and then make sure that it includes your game (note that this wouldn't work for private profiles though). It seems like there's already a bunch of implementations in various languages to query their API though.
Method 2: Steamworks API
Upsides: Seamless integration
Downsides: Requires bundling with another library
If you bundle your game with the Steamworks API then you can use that API to do the calls mentioned in Method 1. They specifically say,
Steamworks provides a variety of methods for authenticating a Steam user between game clients, game servers, and websites.
...and provide a documentation link (but it appears to be broken.
It seems like there's quite a few libraries that wrap the Steamworks API available on GitHub and are probably more.