> WARNING: This method of DRM will keep honest people honest. But determined people will figure out how to break it. This is the case with any kind of DRM.
It seems to me that this is more about essentially preventing the link being shared.
Having not played around with HLS I don't see why this couldn't be done by simply doing an authentication check and refusing to serve content if the auth check fails.
Preventing decryption of the video is obviously impossible as it's being decrypted on the box itself.
The key rotation seems odd to me.
If you're worried about users sharing their session key or something then that can be dealt with on the back end (it surprises me that, for example, YT seemingly don't care about the same IP downloading a ton of videos in parallel with ytdl, say; I suppose NAT makes it slightly more difficult to detect, but not much more so...).
Once someone has the decryption key they have the plaintext. It's the same plaintext for everyone so what does it matter if it's the same key for everyone? Once they have the plaintext they don't have to give some other users your encrypted stream + key, they can just give the other users the plaintext.