Controls stop an unauthorised key-distribution host from transporting, exchanging or establishing keys with POIs: where POIs and KDHs use public-key schemes, each side validates the other's authentication credentials just before any key is transported, exchanged or established, with mutual authentication, for example by matching the device serial number against a list of permitted devices, consulting current revocation lists, or embedding the certificates of authorised KDHs in the devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.