No root cert was involved. Apps built with an enterprise distribution profile, once correctly signed, can be installed on any device. The limit is that it must be an employee’s device. This last rule, broken by GOOG and FB, is exclusively enforced through legal actions.