If the AVR is only passing along HDCP keys and not getting involved more deeply than this, then how is it that the AVR has the ability to decrypt the TDMS streams, which we know it does in order to decode the audio?

In other words, if the BD player is using the key of the display to encrypt the stream (and not the key of the AVR), then the AVR is just a "man in the middle" and should not be able to decrypt the stream.