CA private keys that sign certificates, status lists or messages or protect keys exist only inside a PCI PTS or FIPS 140 Level 3 or higher SCD, encrypted at equal or greater strength per Annex C, or as secret-sharing shares under dual control and split knowledge at all times.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.