Shaka packager doesn't encrypt assets

I am just unable to figure out how shaka player is able to decrypt my CENC protected content even though I am providing invalid decryption keys in player config.

player.configure({
    drm: {
      clearKeys: {
        '6FepeJBbmaiozSMs18vPfA==': '6FepeJBbmaiozSMs18vPfA==', // ==> invalid key
        '6FepeJBbmaiozSMs18vPfA==': '6FepeJBbmaiozSMs18vPfA==', // ==> invalid key
      }
    }
  })   

and here is the arguments given to packager

packager in=video-SD.webm,stream=audio,output=protected_audio.webm,drm_label=AUDIO in=video-HD.
webm,stream=video,output=protected_video_HD.webm,drm_label=HD in=video-SD.webm,stream=video,output=prote
cted_video_SD.webm,drm_label=SD  --enable_raw_key_encryption --enable_raw_key_decryption  \

--keys label=AUDIO:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519, label=SD:key_id=abba271e8bcf552bbd2e86a434a9a5d9:key=69eaa802a6763af979e8d1940fb88392,label=HD:key_id=abba271e8bcf552bbd2e86a434a9a5d9:key=69eaa802a6763af979e8d1940fb88392  \

--base_urls https://s3-eu-west-1.amazonaws.com/dash/ \
--mpd_output h264.mpd

mpd file looks like

<?xml version="1.0" encoding="UTF-8"?>
<!--Generated with https://github.com/google/shaka-packager version 72c4797-release-->
<MPD xmlns="urn:mpeg:dash:schema:mpd:2011" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:mpeg:dash:schema:mpd:2011 DASH-MPD.xsd" xmlns:cenc="urn:mpeg:cenc:2013" profiles="urn:mpeg:dash:profile:isoff-on-demand:2011" minBufferTime="PT2S" type="static" mediaPresentationDuration="PT5.539000034332275S">
  <BaseURL>https://s3-eu-west-1.amazonaws.com/dash/</BaseURL>
  <Period id="0">
    <AdaptationSet id="0" contentType="audio" lang="en" subsegmentAlignment="true">
      <ContentProtection schemeIdUri="urn:uuid:1077efec-c0b2-4d02-ace3-3c1e52e2fb4b" cenc:default_KID="f3c5e036-1e66-54b2-8f80-49c778b23946">
        <cenc:pssh>AAAAVHBzc2gBAAAAEHfv7MCyTQKs4zweUuL7SwAAAAPzxeA2HmZUso+AScd4sjlGq7onHovPVSu9LoakNKml2au6Jx6Lz1UrvS6GpDSppdkAAAAA</cenc:pssh>
      </ContentProtection>
      <Representation id="0" bandwidth="96897" codecs="vorbis" mimeType="audio/webm" audioSamplingRate="44100">
        <AudioChannelConfiguration schemeIdUri="urn:mpeg:dash:23003:3:audio_channel_configuration:2011" value="2"/>
        <BaseURL>protected_audio.webm</BaseURL>
        <SegmentBase indexRange="4601-4619" timescale="1000000" presentationTimeOffset="3000">
          <Initialization range="0-4600"/>
        </SegmentBase>
      </Representation>
    </AdaptationSet>
    <AdaptationSet id="1" contentType="video" width="560" height="320" frameRate="1000000/33000" subsegmentAlignment="true" par="7:4">
      <ContentProtection schemeIdUri="urn:uuid:1077efec-c0b2-4d02-ace3-3c1e52e2fb4b" cenc:default_KID="abba271e-8bcf-552b-bd2e-86a434a9a5d9">
        <cenc:pssh>AAAAVHBzc2gBAAAAEHfv7MCyTQKs4zweUuL7SwAAAAPzxeA2HmZUso+AScd4sjlGq7onHovPVSu9LoakNKml2au6Jx6Lz1UrvS6GpDSppdkAAAAA</cenc:pssh>
      </ContentProtection>
      <Representation id="1" bandwidth="553816" codecs="vp8" mimeType="video/webm" sar="1:1">
        <BaseURL>protected_video_HD.webm</BaseURL>
        <SegmentBase indexRange="336-354" timescale="1000000" presentationTimeOffset="3000">
          <Initialization range="0-335"/>
        </SegmentBase>
      </Representation>
    </AdaptationSet>
    <AdaptationSet id="2" contentType="video" width="560" height="320" frameRate="1000000/33000" subsegmentAlignment="true" par="7:4">
      <ContentProtection schemeIdUri="urn:uuid:1077efec-c0b2-4d02-ace3-3c1e52e2fb4b" cenc:default_KID="abba271e-8bcf-552b-bd2e-86a434a9a5d9">
        <cenc:pssh>AAAAVHBzc2gBAAAAEHfv7MCyTQKs4zweUuL7SwAAAAPzxeA2HmZUso+AScd4sjlGq7onHovPVSu9LoakNKml2au6Jx6Lz1UrvS6GpDSppdkAAAAA</cenc:pssh>
      </ContentProtection>
      <Representation id="2" bandwidth="561429" codecs="vp09.00.21.08.01.01.01.01.00" mimeType="video/webm" sar="1:1">
        <BaseURL>protected_video_SD.webm</BaseURL>
        <SegmentBase indexRange="366-384" timescale="1000000" presentationTimeOffset="3000">
          <Initialization range="0-365"/>
        </SegmentBase>
      </Representation>
    </AdaptationSet>
  </Period>
</MPD>

Either you or someone else asked a similar question on our GitHub page here. It is preferable to ask questions on our GitHub page.

The problem is that asset isn't actually encrypted. It has a clear lead, so the first few seconds aren't actually encrypted. On the GitHub question they explicitly passed --clear-lead 6; but this doesn't pass anything, so Shaka Packager defaults to 10 seconds. This asset is only 6 seconds long, so nothing is encrypted.