The only way I can think is if Nokia operate their own CA and configure the phones to trust it. They then issue their own certificate for any site you visit which your phone will trust.

I don't think that's what is happening, we need further explanation. Although if that is what is happening it;s really bad as they would effectively be impersonating the sites.