I don't know a lot about spoofability, so please excuse that I don't answer the real question. I only want to recommend to write

printf FH "$key %30s", $ENV{$key};
[download]

or

print FH $key, " ", sprintf("%30s", $ENV{$key});
[download]

instead of

my $spaces = ' ' x ( 30 - length($key) );
print FH "$key $spaces $ENV{$key}\n";
[download]

as the printf solutions are shorter, more Perlish and less errorprone.

Greetings,
Janek