It seems that keychain on iOS stores data on a per-app basis rather than per-user.
So if I store information about in-app purchases in the keychain, these products will remain available on the device regardless of which Apple-id is currently logged in.
I could require network-access and perform a restore to know which products should be available, but it seems to be bad practise to do a non user-initiated retore. Also, the app should function properly offline.
My question is: How do I protect in-app purchases from being available to users other than the Apple-id that bought them?
You need to organize user authentication for this - make your users create accounts in your service and provide in your application ability to log in and out for them. After application launch it must check out which user in logged in and provide in-app purchases for that user.