A POI exchanges messages with a certification authority solely to have certificates signed (or for key injection when the CA creates the key pair on the POI's behalf), and with KDHs solely for key management, routine transaction processing and checking certificate status.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.