I wonder if it's feasible (legally and technically) to encrypt the stream between their servers and the plugin, but have the plugin send a local, unencrypted version to the built-in HTML5 plumbing.