Per the proposal on Commons, which had almost unanimous support: "Keep MP4 files, don't allow download of MP4 files nor streaming. Instead, stream Webm version of the MP4 files and allow Webm version of the MP4 file to be downloaded."

Brion's analysis:

Totally feasible technically. There's a couple ways to do this with varying difficulty:

1. Use the original mp4 file as a source for transcodes -- keep it in a private upload area instead of the public one, and don't allow downloads of the original (... do we need an exception for admins and tech fixes?).

or

2. Make a WebM transcode in a special one-off process and save that as the upload -- optionally keep the original mp4 file in a private area.

The upload backend would need some work to support diverting files, and for 1) transcodes and thumbnailing would need to be able to access the embargoed original but I think it's relatively straightforward work. Save to a private area in the file repo similar to how we save archived deleted files and such.

Main downside of 2) is that in current system we can't cleanly land the upload without a file to save, so we either need a placeholder or need some better tweaks to make it show a "file" that exists while the file isn't there. Which is probably similar to work what would need to be done for 1) for "backing file exists, but isn't publicly accessible".