bertrandmt

1. the data is encrypted with the established TLS session key for the current downloading session, i.e. it is indeed a per instance key. Therefore, there is no choice but to encrypt on the go.

2. the CDN cache in fact is the place where this encryption (for the purpose of TLS) takes place. It therefore does not interfere with the CDN function.

As is often the case, reality is less sinister than fantasy: no, I can confidently assert that Netflix does not influence your catalog based on the state of the content cache. The system is entirely built the other way around: the cache will fill to meet expected demand, full stop.