Replace any open hash choice for EC-DSA with the named list, and record for each curve the security level the parameter carries. Where a deployment uses a hash outside the list, record it as a finding with a replacement date rather than a note.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.