Interestingly, Webkit on iOS devices CAN play back DRMd content via the HTML5 video tag. As far as I can tell, the web server can request a special Apple-signed

Interestingly, Webkit on iOS devices CAN play back DRMd content via the HTML5 video tag. As far as I can tell, the web server can request a special Apple-signed client SSL certificate. With this, either the whole video can be streamed via SSL, or you can gate access to the keys used to encrypt the video (via Apple's HTTP live streaming encryption). The latter is of course nonstandard, but cooperative browser vendors could easily implement the pure SSL authentication. I can't imagine Flash or Silverlight video is any more secure than that. There's of course no way a truly open source browser would be trusted in this way; the certificate would have to be hard to extract. (This comment might make me sound pro-DRM. I'm not, just making some technical observations)