DCP-o-matic

I have an encrypted DCP and the studio says they can provide me with a KDM for testing or playback, but they can't provide me with a DKDM. How do I import a PEM file to the studio to create a KDM if I use the DOM for testing and playback of this DCP?
Also, if I want to create a VF package with subtitles for this encrypted DCP, do I only need KDM (not DKDM)?

Technically, KDM and DKDM is exactly the same. It depends on the target system wether you use it as a KDM (projection system) or DKDM (mastering system).

You can export your decryption leaf cert or full cert chain in DCP-o-matic under Preferences->Keys.