The CA system uses a minimum strength of RSA 2048 or equivalent for root and subordinate CAs, KDHs and SCRP devices, and RSA 1024 or equivalent for EPP and PED devices. KDH key pairs have a five-year lifetime unless some other mechanism stops a compromised KDH private key from being used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.