Built-in HTTPS scanning without MITM certificate

How is this possible?