SSL still exists because it works.
There are DRM systems that work in open source using very similar principles (TrustZone being one example). So it can, in fact, be done. Just most places take the easier route.
My point is, you can make it pretty tough while still using open source code.