That can all be faked, just grab all the segments at a timing that would match playing it. This is why Google wants to do that trusted client thing, because there’s no way to guarantee that a user is watching something on their own device unless the software and hardware on that device prevent it and the server makes the user prove they are running that software and hardware and nothing else.