I've never worked on this stuff but I've looked it up before. Essentially, theatres get a DCP but it's unplayable without a Key Delivery Message (KDM).

My understanding is that theatres order these and pay a fee for each one. The KDM is only valid to unlock a specific DCP, on a specific projector, on a specific date and time. It won't work if any of these checks are off meaning you can't check that it works until the theatre is filled with patrons who paid to see your movie, as the KDM will only decrypt the movie seconds before playtime. If there's some glitch, a theatre manager needs to call a hotline for a new KDM.

It's been over 10 years since I worked in a movie theater but this is the gist:

Hard Drives with the film are derived via FedEx and the films are encrypted with symmetric AES keys which are emailed to our theater. These keys allow us to play back the film for a window of time. Sometimes we're sent keys to unlock different times if a film gets an extended release.

Some studios (Disney being the worst) would send you keys late into the evening, requiring staff to stay late to test for the following day. Sometimes they'd send us the wrong keys and it would take a long time to get the correct keys emailed to us.