Physical tokens such as brass keys or chip cards that enable key loading or application signing are never in the control of one person who could load keys or sign applications alone, and are secured like key components, in tamper-evident authenticable packaging with access logs for removal and return to secure storage.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.