L1 - all content processing and cryptography operations are handled inside a CPU that supports a Trusted Execution Environment (TEE).

L2 - only cryptography operations are handled inside a TEE.

L3 - content processing and cryptography operations are (intentionally) handled outside of a TEE, or the device doesn't support a TEE.

This suggests that the media industry only trust you to receive their content if they have some degree of control over what your device is doing. There's an obvious logic to them setting such a requirement, but it does mean rolling out a world wide system where critical security components underpinning our digital societies are resistant to inspection and transparency, by design (and, in many cases, with the full force of the law).

I feel that ultimately this will create a precarious situation and introduce risks that are not justified.

Fun sci-fi exercise: what happens when you mandate legal backdoors for general-purpose crypto, but lock down content so tight that it's NSA-resistant?

Unfortunately I can also imagine that the NSA give themselves backdoors that can even get past the legally-mandated DRM, and the media industries would accept this.

L1 on desktops requires Intel SGX, however, I haven't ever seen this implemented in reality. If anyone has seen it, please share.

Otherwise, L1 exists only on Android and iOS, AFAIK.

The article claims that you can't record HD content from Netflix with L3 DRM. IIRC, that's false. They require L1 only for 4k content.

Doesn't Netflix support 4k on personal computers exclusively on Windows with Edge? Does that use L1?

Kids these days...