Before a certificate is issued for a public key whose request did not originate in the same Level 3 secure room, documented procedures confirm who is requesting it and who will receive it; for KDH requests at least two checks are used, such as proof that the requester holds the private key (a signed PKCS #10 request or equivalent), confirmation that the organisation exists and has authorised the requester, and the other checks the standard lists. In particular: for certificate-signing requests from CAs and KDHs, and for status changes such as revocation, suspension or replacement, the checks establish that the submitter is who it says, may submit on behalf of the originating entity, has a genuine business relationship with the issuer that fits the certificate, and that the request reached the RA securely; RAs keep the records and audit trails of how each entity was identified for every certificate issued or changed, for as long as the certificates live.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.