Uh-oh, nobody wants their face filmed while watching porn.

And again, it is a client app, assume it would be modified by a malicious party.

Just admit the problem is not possible to solve.

Like any other security concern, I don't think it's ever 100% solvable, you just get as close to solved as you reasonably can.

Some security problems are theoretically solvable, some are not. This one is not solvable, you can't get closer to solved as there is no "solved" state.

For example, sending a message between party A and party B so no party C can read it is possible, given that party A and party B have some way to pre-share key. Sending a message from party A to party B in a way that party B knows it is from party A but is unable to prove it to any third-party is, again, possible under some reasonable conditions, see OTR/Axolotl. Sending a message from party A to party B in a way party B can read the message but can't resend it is impossible under any conditions.

In most cases DRM-like functionality is a bullshit. Secret sharing is known to protect against outsiders only. You can use it to split backups so they are harder to steal [1]. The scheme will never work for cases when malicious party has the whole secret at some point in time.

[1] https://www.schneier.com/blog/archives/2010/07/dnssec_root_k...