Thanks, that clarifies my confusion about how this could be realistically implemented. I couldn't see a practical way to verify every device on every connection

Thanks, that clarifies my confusion about how this could be realistically implemented. I couldn't see a practical way to verify every device on every connection via a central authority without massive scaling and reliability issues, but maintaining a small revocation list that can be cached everywhere media is distributed from seems quite practical.