> I won't be able to see what code is running in my browser Yes, but it's not JS. It's a plug-in the EME spec calls "CDM", and it is allowed to be anything, in

> I won't be able to see what code is running in my browser Yes, but it's not JS. It's a plug-in the EME spec calls "CDM", and it is allowed to be anything, including kernel modules and hardware. Websites that sign contracts with CDM plug-in vendors can use these unrestricted plug-ins, but you aren't allowed to check what they're doing because of DMCA.