A computer-readable medium having stored thereon a digital structure defining a digital license authorizing rendering of a corresponding piece of digital content on a computing device, the content being in an encrypted form and decryptable according to a decryption key, the license being issued to a user and comprising: a decryption portion accessible only by the user to whom the license is issued and having the decryption key and validating information including an identification of a root trust authority; and an authorization portion setting forth rights granted in connection with the digital content and conditions that must be satisfied to exercise the rights granted, the authorization portion having a digital signature that is validated according to the identified root trust authority in the decryption portion, wherein the validating information in the decryption portion allows the user to whom the license is issued upon accessing the decryption portion to validate the digital signature of the authorization portion, and the rights in the authorization portion may be exercised by the user only if the conditions in the authorization portion so allow, the rights being exercised by decrypting the encrypted content with the decryption key from the decryption portion and rendering the decrypted content, wherein the decryption portion has conditions that must be satisfied including a condition that the decryption key therein cannot be employed unless the validating information therein is employed to validate the signature on the authorization portion, wherein the digital signature of the authorization portion leads back to the root trust authority identified in the decryption portion, the root trust authority has a particular public / private key pair (PU-ROOT, PR-ROOT), the digital signature is based on (PR-ROOT) or includes a chain of certificates leading back to a last certificate with a signature based on (PR-ROOT), and the identification of the root trust authority as set forth in the decryption portion comprises (PU-ROOT), and wherein (PU-ROOT) is applied to the digital signature to validate same either directly or by way of the chain of certificates, and wherein the decryption portion is encrypted in a form decryptable by the user to whom the license is issued and is tied to such user, wherein the license need not be tied to any particular root trust authority. a decryption portion accessible only by the user to whom the license is issued and having the decryption key and validating information including an identification of a root trust authority; and an authorization portion setting forth rights granted in connection with the digital content and conditions that must be satisfied to exercise the rights granted, the authorization portion having a digital signature that is validated according to the identified root trust authority in the decryption portion, wherein the validating information in the decryption portion allows the user to whom the license is issued upon accessing the decryption portion to validate the digital signature of the authorization portion, and the rights in the authorization portion may be exercised by the user only if the conditions in the authorization portion so allow, the rights being exercised by decrypting the encrypted content with the decryption key from the decryption portion and rendering the decrypted content, wherein the decryption portion has conditions that must be satisfied including a condition that the decryption key therein cannot be employed unless the validating information therein is employed to validate the signature on the authorization portion, wherein the digital signature of the authorization portion leads back to the root trust authority identified in the decryption portion, the root trust authority has a particular public / private key pair (PU-ROOT, PR-ROOT), the digital signature is based on (PR-ROOT) or includes a chain of certificates leading back to a last certificate with a signature based on (PR-ROOT), and the identification of the root trust authority as set forth in the decryption portion comprises (PU-ROOT), and wherein (PU-ROOT) is applied to the digital signature to validate same either directly or by way of the chain of certificates, and wherein the decryption portion is encrypted in a form decryptable by the user to whom the license is issued and is tied to such user, wherein the license need not be tied to any particular root trust authority.