Avainsana: Device-based Conditional Access on-Premises