It turns out we were encrypting with CENC and not CBCS.