In a key-injection facility, key-loading hardware and the passwords or authentication codes that enable it are kept in a secure setting with dual control applied, and are managed so no individual can enable key loading alone; the individual authentication mechanisms themselves need not be under dual control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.