Communication over the public channel needs authentication against man-in-the-middle attacks; information-theoretic authentication with universal-2 hashing needs a shared secret for the first round and can then use keys from earlier rounds, with the combined epsilon following from composability, and any authentication only needs to hold until the key is accepted. By default all public exchanges should be authenticated (sender, receiver, content, time), with the burden on the manufacturer to prove any simplification secure against attacks such as intercept and replay. Common mistakes to avoid: citing a one-way error correction proof for a two-way protocol such as Cascade, unspecified error correction or privacy amplification parameters, ignoring finite-size effects, no rule for multiple-click events, unaccounted leakage (syndromes, authentication key consumption) and side information disclosed in post-processing such as fine-grained timing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.