In this case it is being used to push a new certificate which goes beyond the ability to change default preferences and therefore raises questions regarding the full capabilities available to Mozilla through Normandy.
Apparently the expiration date of the certificate ends up as a pref at some point. I don't remember what the name of the pref is, but someone posted it.