The Host System never writes clear-text keys to persistent storage except in swap or page files and troubleshooting core dumps, and then only to predefined, documented locations on a dedicated drive on its own bus, never backed up or copied, with troubleshooting and forensic tools controlled and authorised by management and every such file securely deleted to industry standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.