A multimedia stream head end includes a legacy conditional access (CA) device that fully encrypts the stream using legacy keys. A copy of the stream is sent to a secondary CA device that encrypts only critical packets in the stream using secondary keys to render a partially encrypted stream. The critical packets in the fully encrypted stream from the legacy CA device are obtained and inserted next to the corresponding critical packets in the partially encrypted stream. Thus, only critical packets are encrypted, with encrypted versions being generated by both the legacy CA and secondary CA without the legacy CA knowing which of the packets that it encrypts are "critical".