Here is an article that should give a little more context (and see my comment on it, same username, for additional info).
iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc.
However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.
This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?