> the projectionist can’t test to see if the KDM works or that the quality of the film is right before show time This seems like a simple and critical feature. If the distributor wishes to impose these extreme constraints on the projectionist, then the projectionist needs to know its going to work well in advance. The projectionist shouldn't even need to be in the room when the movie starts. I've run into this patter…
Except that in this case, you can't test. The only way to test is to load the movie, load a key and play the movie. No key? No movie, and no test. In addition, there is no way the distributor will let you have a "test" key. One of those would be manna from heaven for any unsavory projectionist who wanted to make high quality copies from theater prints.
> One of those would be manna from heaven for any unsavory projectionist who wanted to make high quality copies from theater prints.
Not really. The keys and image decryption happen in a tamper-resistant "FIPS can" in the media server and then are re-encrypted and sent across a bus to the projector. Some newer projectors have the FIPS can directly inside so that there are no physically exposed interfaces with anything other than the full-blown AES encrypted frames. Having a KDM means you can play the movie but you can't ever actually get to the data.
Fun fact: before DCinema there used to be people who owned tele-cine scanners mounted in the back of flatbed trucks that would go around to theaters and pay unscrupulous employees to borrow the film for a couple hours. They'd have an very nice scan of the movie for pirate DVDs the day the movie came out.