Ja, det verkar tyvärr som att jag hade rätt :-(
The host sends an encrypted MPEG transport stream to the CAM and the CAM sends the decrypted transport stream back to the host. The CAM often contains a smart-card reader.