That's the one I used, and if I recall correctly they sent me an email with a link for me to download the cert. This suggests to me that it was generated serve

That's the one I used, and if I recall correctly they sent me an email with a link for me to download the cert. This suggests to me that it was generated server-side and that therefore they could have kept a copy for themselves. But I might be totally wrong on how it works.