This diagram and most of non-normative parts of the spec are a deliberate red herring. The purpose of these is to derail discussion about DRM restrictions by sa

This diagram and most of non-normative parts of the spec are a deliberate red herring. The purpose of these is to derail discussion about DRM restrictions by saying that any restrictions are optional. However, during discussions at W3C Netflix representatives confirmed that their implementation doesn't work like this. They are only interested in "strong" DRM model in which the player is not trusted and has no ability to see decrypted data, so it can't even use its regular HTML5 codec to decode it.