Creating or cloning top-level keys such as MFKs for backup needs at least two authorised people, and every requirement for the original keys applies to the backups and their components.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.