Key pairs are never reused for certificate renewal or replacement; a new pair is generated and each pair yields only one certificate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.