KDHs talk to POIs solely for normal transaction processing and key management, and talk to CAs solely to have certificates signed and to check certificate status.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.