If you want to actually lock down a machine to implement content protection, then you need secure boot without unlockable boot-loader and a pile more bits in userspace.
So let me take my Intel hat off for a moment.
The upstream policy has always been that we don't merge things which don't have an open usable user space. Is the HDCP encryption feature useful on its own ? What do users get from it ?
If this is just an enabler for a lump of binary stuff in ChromeOS then I don't think it belongs, if it is useful standalone then it seems it does belong ?
Alan