For browsers that support EME, they can use the "Clear Key" key system that is part of the EME standard. It's not as secure as other DRM (because the decryption key is briefly exposed on the client), but it does not require any third-party license server like Google Widevine, Microsoft PlayReady, or Adobe Primetime. For a streaming music service, it is probably an adequate deterrent for ripping streams.
