[baybal2]

If they can get the content key out of TZ, they don't even need the per-device key, and TZ based decoder anymore.

They just straight decrypt any files, which were at some point laying in the open on CDNs.

I believe, sooner or later it will come to the point when the only way left for DRMed content to work will be to have each stream individually encrypted, and watermarked at the backend at an enormous computational expense.