A device certificate alone is not proof that an authorised user is operating the device; certificates or keys used to authenticate a mobile device in lieu of compensating controls are protected against extraction, configured for remote wipe on demand or self-deletion after a number of failed attempts, and unlocked only with a secure authenticator such as a password or PIN.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.