Any private key that signs certificates, status lists or messages, or that protects other keys, exists only inside an SCD validated to PCI PTS, or at Level 3 or higher under FIPS 140-3 or its predecessor FIPS 140-2; or encrypted with an algorithm and key size at least as strong, per Annex C; or as shares of a recognised secret-sharing scheme kept under dual control and split knowledge throughout.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.