Sending and receiving devices authenticate each other: the KIF validates a POI's credentials before any key transport, exchange or establishment, the POI validates the KDH's, and where a KLD sits between POIs and the KIF HSM no unauthorised SCD can be inserted into the flow undetected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.