@Yannick Thanks for the update. But I'm conviced that this is a WebKit bug or that Safari "cheats."
Safari uses FairPlay DRM, which is integrated at the system level through AVFoundation — it's not a WebKit feature per se, and Apple doesn't expose it the same way to every process.
More importantly, other third-party WebKit browsers (Click, Emerald, and Nook) all handle DRM content fine on Mac. These browsers use standard WKWebView and the system's stock WebKit processes, which inherit Apple's pre-verified entitlements and code signing. The FairPlay handshake works because the OS recognizes those WebContent processes as trusted.
Compatibility Mode doesn't fix this issue in Orion so the problem probably isn't extension interference and it's more likely related to how Orion's custom WebKit build interacts with the Verified Media Path. When Orion compiles its own WebKit binary (to support Chrome/Firefox extension APIs), the Mach-O signing and Hardened Runtime entitlements on that process may not pass Apple's internal VMP check. If the process has loosened security flags — like com.apple.security.cs.allow-unsigned-executable-memory — to allow extension script injection, FairPlay will reject it.
So the fix probably isn't upstream in WebKit. It's in how Orion's processes are signed and entitled. The other WebKit browsers getting DRM to work proves that the system-level access is there — it just requires maintaining the standard entitlement chain that Apple's FairPlay expects.
I understand this might be a hard architectural problem given that Orion's extension support depends on modifying the WebKit process, but it would be great if you could fix it.
