An asymmetric key pair is generated inside the device that will use it; where it is generated elsewhere, the pair, together with every associated critical security parameter such as seeds, is zeroised as soon as the transfer into that device is complete.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.