A "known key" attack isn't an attack at all, cryptographically speaking.
In addition: it doesn't even look like they're meaningfully using "web crypto" APIs, but rather the much-debated proposed DRM blob APIs.
App store apps have also been cracked in that their keys have been stripped, on a jail broken phone you can run all those apps without needing a valid key.
I don't know if Requiem has been keeping up with the latest iTunes releases.
However, you are onto the right track. One proposed solution to DRM (that I believe was impleneted with DVD and/or blueray) is to establish a chain of trust in the hardware. The idea would be that you send an encrypted signal to the monitor, and the monitor has a tamper resistant decryption chip with its own key.
Obviously, this only gets you so far, as once someone cracks the chip (or acquires the master key through other means, as happened with DVD), then the entire scheme is broken.
Ultimatly the problem is that you need to provide the user with enough information for them to be able to view the decrypted content, while at the same time not let them know the decrypted content. The real question is how difficult/expansive can you make it to bypass. Unfourtantly, in every system I am aware of, once one person figures it out, it become cheap and easy for every else; and coming up with a new crypto-system is a great way to get the academic community to try and break it.
For anyone interested, it looks like HDCP has been broken on pure crypto grounds [1]. As much as I agree that this type of DRM is fundamentally not possible, I'm still kind of surprised that their was a direct attack on the crypto.