Rough draft of EME Concerns document.

As discussed in various forums, this is a version of the opinion document that tries to catalog our concerns for EME as a web-facing API, without suggesting solutions or focusing on specific technical choices or problems with the current mechanism. Feedback definitely welcome.

WAT.

The non-encrypted web is legacy. It's going away. To get there, we need both carrots and sticks. To suggest that it's "anti-little-guy" to require SSL for some features when _The New York Times_ isn't encrypted requires torturing definitions to the breaking point.

Yes, SSL is too hard to set up today, but it's at the level of difficulty that _most_ crypto systems suffer from, including EME. Claiming that there's some onerous delta in ensuring that you have installed/validated certs for transport when you must do _the exact same thing_ for content encoding is....O_o.