A CA that issues certificates to other CAs and to KDHs runs offline on a dedicated closed network used only for issuance and revocation, with outside access only from a separate platform in a DMZ that pushes certificate status to relying parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.