The parts involved in protected Audio/Video path do have their own encryption keys and hardware support outside of anything touched by the OS. In fact it's major part of what Intel Management Engine does if you do not have the "advanced" license for remote management, and AFAIK why AMD PSP on normal AMD cpus has closed source firmware. Both are responsible for setting up protected media path and both are interrogated by DRM modules to setup encryption.