It compares the certificate received for a https site from different locations on the internet, on the assumption that a man in the middle attack would not be able to hijack all locations. If the received certificate differs at different sites, a flag is raised.