Keys must be protected against unauthorised use throughout their lifetime and against misuse by their owners, through storage in secure hardware or secure software with authorisation checks. Wherever encryption is supported, organisations must hold secure key backups (so that data stays recoverable for internal purposes or for law enforcement), while non-repudiation keys must remain solely in the user's control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.