The ServerAuth agent is installed when you add a new server to your account. We give you a 1-line install command via the on screen instructions.
This checks for the latest stable release on github, and downloads it. It then places it in an executable location on your server, and creates the configuration file. Finally, it sets up the cron job to periodically check for any SSH key updates in your account. This is generally done at 10 minute or 1 minute intervals depending on your subscription plan.
Every time the ServerAuth agent checks the ServerAuth platform for updates, it'll update the authorized_keys file on each of the system accounts you've set up to use ServerAuth.
If, for whatever reason the agent is unable to connect to the ServerAuth platform to retrieve the latest keys, it will always retain the current authorized_keys file to prevent you being locked out of your server.