Mechanisms confine every key to its designated purpose so that keys are used in accordance with the certificate policy, in the manner RFC 3647 frames. In particular: cA certificate-signing keys, certificate status signing keys and keys that sign updates to authorised host lists in encryption devices serve nothing beyond subordinate certificate requests, status checking and self-signed roots, whether combined or as separate dedicated keys; a CA that issues certificates to other CAs does not issue certificates to POIs; no CA signs both subordinate CAs and end-entity devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.