on my way home from ph-neutral I had the chance to take a brief look at the Touch-and-Travel NFC tags. Using my BtNfcAdapter on my Nokia 6131 NFC I took a copy of the tag data home with me, you can get it here (you need bahn.py to read it).
It turns out that the tag actually doesn't contain any data besides showing a custom type record. TNF: 4 and Type: db.de:tandt. It only took me a couple of seconds :-) to realize that the custom type is only used to launch the touch-and-travel application on the phone. The touch-and-travel tags are NOT just simple Mifare Classic tags but some other ISO14443 card so I guess there is more data stored on the card and you just need to know how to read it :-)
I'm really looking forward to the day this system is being opened to the public. Until then this is as good as it gets.
Touch blog about Touch-and-Travel