The point of EME is to minimize the amount of code that differs between platforms, by standardizing everything but (in essence) the authenticated key derivation step.
The point of EME is to make it impossible for a browser to show a web page without having financial deals with the websites (or a 3rd party representing the websites).
That is what people oppose. The fact that you do not directly address this point and try to equivocate it to <input type=password> makes me question your good faith here.
This is false. EME describes only the interface between the Javascript environment and the CDM. It says nothing about the CDM's interface with the browser code, which is the heart of the issue.
You're rebutting an argument I didn't make. The CDM is closed-source, but it was closed-source in the pre-EME world too. My argument is that EME opens up DRM stacks; it's that it opens up more of the DRM stack than was open before it.
> by standardizing everything but (in essence) the authenticated key derivation step.
Your argument is that EME covers most of the code responsible implementing DRM. This is false. EME is a small part. The large majority of the implementation is not standardized. For example, there is no equivalent of NPAPI in the post-EME world; the CDM/browser interface is browser-specific.
No, that's not my argument, as you can see from my comment above. What you've done here is twist my argument around to introduce claims I didn't make that you find easy to rebut.
> by standardizing everything but (in essence) the authenticated key derivation step
Is there another interpretation of 'everything' in this context? You're making EME far more comprehensive than it is. CDMs do way more than derive a key, so your statement is false on its face.
It works the same regardless of what browser or OS you are using.