A secret or private key exists only as two or more separate shares or components of full length, encrypted under a key whose strength is equal or greater per Annex C, or within an SCD; a key-injection facility may keep clear-text material outside an SCD only inside a secure room that meets Annex B Requirement 32.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.