pay-to-decrypt in the browser is the right shape, no drm needed