The Conway specification retrieves the credentials needed by a tx using the function credsNeeded. The result is then filtered to separate keyhashes from scripts. The former are validated by the UTXOW rule.
credsNeeded currently filters out credentials coming from votes from SPOs. This is not correct. For reference the implementation takes into account those (see here).