A method, comprising: at a central location of a multichannel video programming distributor (MVPD): receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD, and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application, wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN,; providing the processed content over the virtual private network to a second router that sends data to a conditional-access encoder, wherein the first router, the virtual private network, the receiving virtual private net- work and the second router compose a bridged private network providing a secure data link, wherein the user interface overlay graphics are transmitted to the set-top of the customer in an unencrypted form separately from the encrypted video stream and other than via the secure data link; encrypting the processed content using the conditional-access encoder; and transmitting the processed content as encrypted by the conditional-access encoder to the set-top of the customer; and at the set-top of customer, performing overlay rendering of the user interface overlay graphics with the content decrypted at the set-top of the customer. at a central location of a multichannel video programming distributor (MVPD): receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD, and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application, wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN,; receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD, and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application, wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN,; providing the processed content over the virtual private network to a second router that sends data to a conditional-access encoder, wherein the first router, the virtual private network, the receiving virtual private net- work and the second router compose a bridged private network providing a secure data link, wherein the user interface overlay graphics are transmitted to the set-top of the customer in an unencrypted form separately from the encrypted video stream and other than via the secure data link; encrypting the processed content using the conditional-access encoder; and transmitting the processed content as encrypted by the conditional-access encoder to the set-top of the customer; and at the set-top of customer, performing overlay rendering of the user interface overlay graphics with the content decrypted at the set-top of the customer.