PAVP (Protected Audio-Video Path, which has gone by other names), as described in the FAQ entry, is a real thing, albeit without any public documentation whatsoever other than acknowledging that it exists - implemented in ME and used by some commercial video DRM implementations. Not sure what kind of citation you want, but it's briefly mentioned in this presentation about reverse engineering ME:

https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

SGX is the other feature needed for DRM. Just read Intel's own documentation for SGX; it's all about creating a Trusted Computing environment, using the old Palladium/NGSCB sense of "trusted".

ME also controls the feature set available to the storage controller. I.E. whether or not it can support RAID 0, 1, 5 natively. Its features can be updated via BIOS firmware, which has to correspond to whats baked into the CPU. It can be bypassed using a special version of BIOS firmware in combination with a cpu with the right fuses blown. It almost takes an act of god to get all those things, even in their lab, when you're getting paid to test it.

Really? That surprises me.

AFAICT Intel's desktop RAID tech literally just remaps PCI vendor and device ids (which is a wee bit more complicated with NVMe / AHCI over SATA Express). The boot process was an option ROM and is presumably now baked into UEFI. The driver does the rest.

I can imagine that a couple bits in ME tell the UEFI blob and the driver which feature set to enable. Is there more?