Mechanisms stop an unauthorised host from injecting keys into POIs, and stop an unauthorised POI from setting up a key with any genuine component of the KIF.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.