The generation of higher-level keys, for example KEKs shared with other organisations, MFKs and BDKs, is logged with the date and time, the key identifier, its purpose, the names and signatures of the people involved, tamper-evident package numbers and device serial numbers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.