A key-injection facility protects devices from the manufacturer to key insertion by a trusted courier with secure storage, by secure trackable packaging, by a device-unique transport-protection token the injection SCD verifies, or by device self-authentication, and a tampered device becomes unable to accept keying material.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.