The keydumper is designed and compiled to be launched on TV itself, remote machine only sends Telnet command (that's why root is mandatory). It cannot be otherwise.
Basically, it hooks function to catch key "as if TV was going to need it to playback a recording" and write it to a keyfile.
edit: about your edit: Yeah, the menu accessed by technician with a special remote (or a few other known ways) is called Service Menu, you can check wiki there's no mystery around it (be extremely careful though, you may break...again your TV)
http://wiki.samygo.tv/index.php5/Service_Menu
http://wiki.samygo.tv/index.php5/Remote ... ransmitter
About keys, they're specific to each TV and different for each recording, I wonder how you could find them just by looking at 'a serial number' for example. It's not a 'generic' one you'll find on the web like your Windows or Wifi password.
Anyway, If you find a better solution, feel free to tell us
