An asymmetric key pair is generated inside the device that will use it; if it is generated elsewhere, the private key, together with every related critical security parameter such as seeds, is zeroised as soon as the transfer into that device is complete.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.