> From the browser's point of view there is not really any significant difference between a video that is encrypted for DRM and one that is encrypted for privac

> From the browser's point of view there is not really any significant difference between a video that is encrypted for DRM and one that is encrypted for privacy. In the former case those who encrypted it want to keep the key secret from the viewer, whereas in the latter case they want to keep the key secret from third parties. To the browser, these look the same: there is encrypted video, and the browser needs something to decrypt that and hand it the decrypted data for it to display. If you hiding the key from person who is intended recipient you are implementing a DRM, not solution that provides privacy. The problem that you are mentioning is already solved, and you don't need to hide key from the viewer. It happens as follows: - content is encrypted using randomly generated symmetric key - the key is then encrypted using asymmetric public keys of recipients The recipient has all information necessary to decrypt the information. If your goal is to hide from the recipient the one time key that is only used for the content that the recipient supposed to be able to view, then you're implementing DRM.