Browser-based broadcast encryption demo — NNL 2001 subset-difference. Encrypt once to a subset, revoke a member without touching anyone else's keys, then trace a leaked decoder back to the traitor by watching what it can and cannot open. Collude past the bound and tracing fails. The math behind AACS. No backends. No simulated math.