Three vendors are involved. Should be announcement within the next month. Receives and parses certificate. It then sends it off to the vendor for validation. Individuals can get multiple ACES certificates.
Vendors can track certificate use, but only to detect fraud.
The vendors can help generate the keys for the ACES certificate. This is not required. The individual can generate their own key pair. It is up to the individual to determine how they store and protect their private key. Each vendor must be able to deal with some kind of hardware token for private key storage.