The key protecting the DDK in transit is no weaker than the DDK, is unique to each Host System, is used solely to encrypt DDKs passing between the HSM and that host, and has a defined crypto-period set by industry practice and by how many keys it protects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.