Key Delivery Quick Reference — the license flow and the secret map

A one-page reference for key delivery before you lock the architecture or sign a DRM contract: the EME license-acquisition flow (encrypted → generateRequest → message → POST with an entitlement token → update → key in the CDM), the 'who never sees the key' secret map (the clear content key only in KMS/HSM, the license server, and the CDM; default_KID is a public name; the communication key never in the client), the three dialects (Widevine license request; PlayReady challenge + KID; FairPlay SPC