I know. It is still unclear if the leaked certificates were used by both Widevine and Playready. 1) The account name posting to Github was called "Widevineleak", and 2) The timing of this aligns with people starting to receive letters from Amazon.
AllNight
Isn't SF a passive program? The data comes our way, it is decoded locally, so a key exchange never really takes place in that sense. It's not like SF says,"Hello AMZ, I am SF. Now give me that file!"
As far as AMZ is considered, it's a Chromium browser requesting access to a protected video and is in a secure playback environment. Said secure environment requests the key for playback purposes. No other info is really shared so AMZ doesn't suspect anything based on just that.
