A method, comprising: at a central location of a multichannel video programming distributor (MVPD) : receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD ; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD , and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application , wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN, ; providing the processed content over the virtual private network to a second router that sends data to a conditional-access encoder , wherein the first router , the virtual private network , the receiving virtual private net- work and the second router compose a bridged private network providing a secure data link , wherein the user interface overlay graphics are transmitted to the set-top of the customer in an unencrypted form separately from the encrypted video stream and other than via the secure data link ; encrypting the processed content using the conditional-access encoder ; and transmitting the processed content as encrypted by the conditional-access encoder to the set-top of the customer; and at the set-top of customer, performing overlay rendering of the user interface overlay graphics with the content decrypted at the set-top of the customer. at a central location of a multichannel video programming distributor (MVPD) : receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD ; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD , and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application , wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN, ; receiving encrypted content, which comprises encrypted video, from a con-tent provider, wherein the content provider is distinct from the MVPD ; decrypting the encrypted content; processing the decrypted content in a virtual set-top application associated with a set-top of a customer of the MVPD , and generating user interface overlay graphics, wherein the set-top of the customer is located in a customer premises remote from the central location, and providing the processed content to a first router linked to the virtual set-top application , wherein the first router is further linked through a virtual private network, VPN, to a receiving virtual private network, VPN, ; providing the processed content over the virtual private network to a second router that sends data to a conditional-access encoder , wherein the first router , the virtual private network , the receiving virtual private net- work and the second router compose a bridged private network providing a secure data link , wherein the user interface overlay graphics are transmitted to the set-top of the customer in an unencrypted form separately from the encrypted video stream and other than via the secure data link ; encrypting the processed content using the conditional-access encoder ; and transmitting the processed content as encrypted by the conditional-access encoder to the set-top of the customer; and at the set-top of customer, performing overlay rendering of the user interface overlay graphics with the content decrypted at the set-top of the customer. <EOS>