Default How does OTA Root Keeper work?

Just want to get educated. I did search but was not able to find an answer.

I understand it can make a copy of su.

How does it temp un-root? Does it remove the su from bin folder?

Then, most confusing, how does it restore it? It would have to copy the su back to bin, right? How does it gain permission to do so? Is it a binary with setuid bit set?

gTablet, DRH Jelly Bean 4.3
Kindle Fire HD 8.9, PAC-man
Moto X XT1058, AT&T 4.4
Samsung Galaxy S4 i337, AT&T, 4.3 rooted