Revocation is handled through certificate revocation lists, online certificate status or server-based validation with recovery after an end entity's revocation; trust may rest on non-PKI self-signed certificates where a PKI is not available; and authorization and validation lists (signed lists of the entities a device may communicate with and the restrictions) support constrained environments that cannot perform full validation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.