The DDK is kept encrypted while it passes from HSM to Host System, either under a fixed transport key or through a cryptographic protocol, and the HSM stays within the security policy that goes with its FIPS 140 Level 3 or PCI HSM approval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.