DRM is added at the last hop before the content is sent to the client. It has to be, because the key is different per client.