Any key-encryption key used to send or convey another key is at least equal in strength to the key it protects under Annex C: TDEA KEKs are triple-length or longer (112 bits of strength) and used in encrypt-decrypt-encrypt mode, a weaker TDEA key never encrypts a triple-length TDEA key, TDEA never protects AES keys or any key stronger than 112 bits, and RSA transport keys meet the Annex C strength for the keys they carry.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.