The first terminal master key or initial DUKPT key is loaded using asymmetric techniques or manually through the keypad, IC cards or a key-loading device; subsequent loads may also encrypt the replacement under the current TMK or, for AES DUKPT, use a derived update key carrying a new initial key ID; a compromised device is never reloaded with keys and is taken out of use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.