A key pair generated outside the device that will use it is transferred and loaded securely so that the private key stays secret and the public key's integrity is assured, and once injected the pair is unavailable for injection into any other POI, keeping key pairs unique per device.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.