A method of processing content in a client computing system, comprising: obtaining encrypted content and a key blob having at least one encrypted title key associated with the encrypted content from a service provider server; obtaining an ad digest and an ad cache from the service provider server, the ad digest comprising information describing where ad slots are located in the encrypted content, and the ad cache comprising ads for insertion into the ad slots in the encrypted content; wherein a hardware-based root of trust between the client computing system and the service provider server is established; the method further comprising: controlling content processing on the client computing system by a security processor of the client computing system; passing the at least one encrypted title key associated with the encrypted content from the security processor to a graphics engine over a protected chip to chip data interface; selecting, by the security processor, ads from the ad cache for insertion into the encrypted content based on the ad digest and local contextual information; passing the encrypted content and the selected ads to the graphics engine over a protected audio/video path at the full system memory bandwidth without compromising performance or security; inserting the selected ads into the ad slots in the encrypted content within the graphic engine; decrypting, decoding, and decompressing the encrypted content using the encrypted title key received from the security processor, and composing display image data with the selected ads inserted into the content at the ad slots, within the graphics engine; re-encrypting the display image data within the graphics engine; and passing the encrypted display image data to a display over a protected display interface. obtaining encrypted content and a key blob having at least one encrypted title key associated with the encrypted content from a service provider server; obtaining an ad digest and an ad cache from the service provider server, the ad digest comprising information describing where ad slots are located in the encrypted content, and the ad cache comprising ads for insertion into the ad slots in the encrypted content; wherein a hardware-based root of trust between the client computing system and the service provider server is established; the method further comprising: controlling content processing on the client computing system by a security processor of the client computing system; passing the at least one encrypted title key associated with the encrypted content from the security processor to a graphics engine over a protected chip to chip data interface; selecting, by the security processor, ads from the ad cache for insertion into the encrypted content based on the ad digest and local contextual information; passing the encrypted content and the selected ads to the graphics engine over a protected audio/video path at the full system memory bandwidth without compromising performance or security; inserting the selected ads into the ad slots in the encrypted content within the graphic engine; decrypting, decoding, and decompressing the encrypted content using the encrypted title key received from the security processor, and composing display image data with the selected ads inserted into the content at the ad slots, within the graphics engine; re-encrypting the display image data within the graphics engine; and passing the encrypted display image data to a display over a protected display interface. controlling content processing on the client computing system by a security processor of the client computing system; passing the at least one encrypted title key associated with the encrypted content from the security processor to a graphics engine over a protected chip to chip data interface; selecting, by the security processor, ads from the ad cache for insertion into the encrypted content based on the ad digest and local contextual information; passing the encrypted content and the selected ads to the graphics engine over a protected audio/video path at the full system memory bandwidth without compromising performance or security; inserting the selected ads into the ad slots in the encrypted content within the graphic engine; decrypting, decoding, and decompressing the encrypted content using the encrypted title key received from the security processor, and composing display image data with the selected ads inserted into the content at the ad slots, within the graphics engine; re-encrypting the display image data within the graphics engine; and passing the encrypted display image data to a display over a protected display interface.