A website can decide which Content Decryption Modules it would like to support, because ultimately the site runs the keyservers and can decide which CDM's keys it would like to generate.

But EME includes a fully freely implementable Clearkey spec. Ultimately sites generally don't want to generate keys for it, but it can be done.