They could verify the server's certificate. Even if the user installs a new (trusted) certificate - as in this case - the app could still check the certificate information (fingerprint, domain name, O, etc.).
I assume The Daily is using NSURLConnection. Doesn't NSURLConnection by default reject self signed certificates?
Verify the certificate you get during the SSL connection is the certificate you expect to see.