Comment by GoblinSlayer

Apparently by plugging into the handshake process the auditor can verify the session key and MAC. The idea is simple: you just save a full replay of the session and thus it can be verified to be legitimate.