[maxerickson]

The mozilla blag this links says this:

For extensions that will never be publicly distributed and will never leave an internal network, there will be a third option. We’ll have more details available on this in the near future.

That sounds like admin installed certificates in the browser to verify the local signatures.