an auth/factotum is started by some initialisation code when you boot and log in to your terminal.
on the cpu server, the same is true for the host owner (the owner of the cpu service),
but then when you cpu(1) into a cpu server, your profile has a switch on the service environment variable,
which is "cpu" for an incoming cpu call:

h% cat $home/lib/profile
...
switch($service){
case terminal
...
case cpu
...
bind /mnt/term/mnt/factotum /mnt/factotum
...
}

within cpu, the terminal's name space is available at /mnt/term, so it simply binds the /mnt/factotum
in that name space onto /mnt/factotum in the cpu server, so you have all your keys.

Note that this is a simple way in which the use of file servers to provide system services and resources,
combined with 9P to import and export them, allows an interesting function to be provided without having
any further code or special protocols.