1. A method of authenticating rights to content items in a domain comprising a plurality of devices sharing a domain key, the method comprising acts of: at least one Content issuer device providing a content item to the devices in the domain without an associated rights object; one or more Rights Issuer devices that are not members of the domain, do not have access to the domain key, and are different from the at least one Content issuer device encrypting the associated rights object for each content item using a diversified key derived from the domain key and unique to each Rights Issuer device; and supplying the encrypted associated rights object to the devices in the domain, wherein the content item is authenticated when its associated rights object a decrypted using the domain key.