NIS+ trusted and password maps

[David Nixon]

Following guidelines from "Configuring and Administering NIS+" I set up a NIS+ master service on a trusted system
and populated its password map from /etc/passwd (minus root
and sytem type entries . After starting 'ttsyncd' , a trusted map
was created.

Non root users couldn't login via NIS+ , since this new
trusted map contained empty encrypted pwd fields ; meaning
that the starred out pwd fields in my password map were
locking access. I was expecting 'ttsyncd' to create a trusted
map by garnering pwd information from /tcb/files/auth ...

Two related questions:

Where are encrypted pwds meant to reside
on a trusted system running NIS+ ?

If password map is the place for them then what are the
security implications ?