I think that option #5 is ideal. I don't believe that DRM belongs in the HTML spec. I see the spec as more of a toolkit to support whatever it is you need done (video/audio APIs, canvas, etc). DRM features should exist at the user level, preferably in the browser (as you have pointed out) or as it currently stands in an external plugin.