A key-injection facility moves keys only in encrypted form, as at least two components or shares each of full key length, or held within an SCD. Clear-text components are carried in SCDs or in tamper-evident packaging that can be authenticated, and components that together could form a key go by separate channels, with package serial numbers sent separately and checked before use. Where an HSM or KLD is shipped already loaded with keys, it needs dual-control mechanisms to be made operational and those mechanisms travel by a channel other than the device's own, and every SCD is inspected for tampering. Using one channel on different days to send the components does not satisfy this.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.