The compromised CA notifies superior and subordinate CAs, and the damage analysis decides whether subordinate CAs and KDHs need reissued certificates distributed to them or notice to apply for new ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.