A key-derivation construction is usually chosen when the implementation already manages keys or when the evaluator's platform exposes a derivation primitive but not a general hash. That can be a sound engineering choice, and it can also be an accident. The buyer should ask why this route was chosen, not only which primitive it uses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.