priv: Remove references to transferring `tunnel_ops *' pointers.

None of that happens since the helper became a separate executable;
instead, tunnel driver names are passed.  I've taken the opportunity to
fix other fossils in the privilege-separation commentary.

No substantive changes.