Techniques for a trusted system for secure content distribution and trusted recording of content consumption are described. In some embodiments, the trusted system transcodes and transcrypts a media content item using a key obtained from a content provider and one or more keys based on an entitlement from a service provider to generate an encrypted media content item. The trusted system further receives a request to provide the media content item to a client device. The trusted system also obtains a signed audit token recording the request upon an authorization by the service provider based on the entitlement and a confirmation by the content provider, where the signed audit token is signed by the content provider and the service provider. The trusted system additionally provides the one or more keys for decrypting the encrypted media content item and reports the signed audit token.