Mechanisms stop an unauthorised key-distribution host from transporting, exchanging or establishing keys with POIs. Where POIs and KDHs use public-key schemes, each side validates the other's authentication credentials immediately before keys are transported, exchanged or established, so that authentication is mutual; examples include checking the device serial number against a list of permitted devices, checking current revocation lists, or embedding certificates of authorised KDHs in the devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.