POIs talk to a certification authority solely to have certificates signed (or for key injection where the CA generates the key pair on the POI's behalf), and talk to KDHs solely for normal transaction processing, key management and checking certificate status.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.