content: They're making their own client certificates with a fake chain of trust. When you create a client cert, you can sign it with any CA cert even one you make and give it any name. This is because the browser doesn't need to chain back to a root CA it trusts for client auth with a cert. This just relies on investigators seeing the name of a well known company and not actually verifying the signing cert is legit.