Each 3DS Requestor builds an EMVCo-approved 3DS SDK into its app and have a mechanism to authenticate the app to the requestor, including confirmation that the embedded SDK is unchanged; the SDK encrypts the device information for the DS with the DS's public key using the specified JWE scheme, and the DS decrypts it before forwarding to the ACS.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.