Based on what I've read in the actual implementation discussion in Bugzilla, the process actually consists of:
1. A Mozilla-controlled server hosts bundles of tiles, which are periodically updated.
2. The browser periodically downloads updated bundles of tiles from that server.
3. Using metadata in the bundles, the browser decides which ones to display.
A lot of discussion seems to have centered on ensuring the bundles and their metadata have enough overlap to ensure that even Mozilla's servers can't determine which sites in the browser history caused a particular tile to display.