A key is moved in one of three forms: encrypted, split into at least two full-length clear-text components or shares, or held inside an SCD. Clear-text components are carried in SCDs or in authenticable, tamper-evident mailers bearing pre-printed numbers; the components that together form a key go by separate channels, and serial numbers are sent separately and checked before use; where an SCD carries a component, the means of extracting it goes by another channel; an HSM or KLD shipped with keys already loaded needs dual-control mechanisms to become operational, and those mechanisms travel separately from the device; every SCD is inspected for tampering.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.