A few question about the EME proposal: > BTW, open source browsers can easily implement this spec since it doesn't require the browser to implement a "decrypti

A few question about the EME proposal: > BTW, open source browsers can easily implement this spec since it doesn't require the browser to implement a "decryption module" themselves. Does this mean, that the 'decryption module' is necessary closed source? And from the spec: >4.1 "Secure proof of key release must necessarily involve the CDM due to the relative ease with which scripts may be modified. The CDM must provide a message asserting, in a CDM-specific form, that a specific key or license has been destroyed. Such messages must be cached in the CDM until acknowledgement of their delivery to the service has been received. This acknowledgement must also be in the form of a CDM-specific message. " Perhaps I misread, but the datastream is relayed from the browser to the CDM ( and the browser loads and potentially modifies the CDM), so how does the standard ensure that the proof of destruction is actually a message from the CDM and not from the browser? >9.1 "Everything from user-generated content to be shared with family (user is not an adversary) to online radio to feature-length movies." Does this imply that from the standpoint of the proposal the user is an adversary, unless specifically noted?