For public key-based authentication enforce authorised access to the private key and map the authenticated identity to the individual's or group's account, and where PKI is used validate certificates by building and verifying a certification path to an accepted trust anchor with status checking, and keep a local cache of revocation data to support path discovery and validation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.