Encrypted content streaming is provided by a method comprising holding an encrypted content stream that is cryptographically encrypted from a content stream with a content key, and holding an encrypted content key that is cryptographically encrypted from the content key with one or more blackout encryption keys. Each blackout encryption key is paired to a blackout decryption key corresponding to a specific audience, and each blackout decryption key is obtainable by audiences other than the specific audience corresponding to the blackout decryption key. The method further comprises serving the encrypted content stream to the plurality of different audiences. The encrypted content stream is embedded with a leaf license comprising the encrypted content key, and the encrypted content key is cryptographically decryptable by audiences having the one or more blackout decryption keys paired to the one or more blackout encryption keys.