Could you add a WPDM-mega (similar to amazon S3 but support for using mega’s API’s) https://github.com/smartinm/mega-php-client
instead of the direct URL to the mega.co.nz download link which contains the decryption key, if the link was a POST operation to the mega URL (the download would work without revealing the decryption key to the end user)
eg: mega URL with decryption key is : https://mega.co.nz/#!CMJECbqZ!K0x-1hy_LSRoPLTY7G47RWbqaxQ5Z34MZ1-0Ufjb-7c
therefore instead of doing a GET operation on that URL if you instead do a POST to https://mega.co.nz/#!CMJECbqZ with the decryption key as a POSt variable, the file can be downloaded ONLY via the WPDM-mega module and no direct download link to https://mega.co.nz/#!CMJECbqZ would work as the decryption key is always hidden.
.
