SONs get paid out from a daily reward pool for signing transactions and the weight of voting. Both the transactions they approve and reject are counted in. Bitcoin transactions in Peerplays blockchain get validated to ensure they originated from the SONs.
When a SON changes, their private key on the bitcoin address gets replaced with the private keys of the new incoming SON.
The performance of SONs is also tracked. Their errors, uptime, missed blocks, and similar errors provide historical performance data for voters. Witnesses have the power to freeze a SON or blacklist them if necessary.