Digital rights management is described involving a device, a content issuer, and a rights issuer. A content encryption key (CEK) is encrypted using a public key associated with the device to produce an encrypted CEK. The encrypted CEK is encrypted using an issuer encryption key to produce a twice encrypted CEK. The twice encrypted CEK is encrypted using the public key to produce a ciphertext included in a rights object. The rights object is available to the device for decrypting digital content associated with the content issuer. The device can then decrypt the rights object ciphertext using its private key to produce a decrypted rights object ciphertext and decrypt the decrypted rights object ciphertext using an issuer decryption key received from the content issuer to produce an encrypted CEK. The encrypted CEK is decrypted using the private key to obtain the CEK, which is then available for decrypting digital content.