Where code signing is used, the maker has procedural and technical controls against unauthorised access to or change of the private signing keys; at survey it shows management system evidence of policies, roles and technical controls such as restricted access and hardware security modules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.