I just looked at the service access list for eShop version 0x65 (10.0 or 10.1 or something along those lines).
It really says
am:sys there. That's the same as what home menu has (and the reason why a particular FBI release found the am service but couldn't install CIAs after all) and really is unsifficient. tiger also has
nim:s, though, which in turn has am:net. So I'm wildly guessing this is what happens:
- tiger causes creation of the ticket
- tiger passes the title ID to nim
- nim downloads the ticket and the title from the CDN, decrypts it and passes that off to am:net streamingly
- am:net then proceeds to actually install the ticket and title received from nim