HTML5 DRM (EME) only defines an interface between the DRM system and the browser, it doesn't specify the mechanism for the DRM itself, the CDM is a black box . You could have a DRM scheme based on ROT13 and it would be entirely valid.

https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med...