From what I understand, the Widevine certificate is just metadata about the content and the expiration date of the license and that's signed by a trusted root a

From what I understand, the Widevine certificate is just metadata about the content and the expiration date of the license and that's signed by a trusted root and encrypted for the device's key. So yes, I might have to copy the keyfile off my TV somewhere or install an online-provided file onto my TV. But that would both be possible. (From what I understand, a common way how DRMed content ends up on RARBG is that people copy the key out of their TV and then use that to decrypt the Widevine-protected content, so the key inside the device appears to be the sole source of trust)