I've never worked on this stuff but I've looked it up before. Essentially, theatres get a DCP but it's unplayable without a Key Delivery Message (KDM).

My understanding is that theatres order these and pay a fee for each one. The KDM is only valid to unlock a specific DCP, on a specific projector, on a specific date and time. It won't work if any of these checks are off meaning you can't check that it works until the theatre is filled with patrons who paid to see your movie, as the KDM will only decrypt the movie seconds before playtime. If there's some glitch, a theatre manager needs to call a hotline for a new KDM.