The CA system uses at least RSA 2048 or equivalent strength for root and subordinate CAs, POI devices and KDHs, and KDH key pairs lapse after five years unless some other control stops a compromised KDH private key from being used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.