No, they don't. The keys are generated using in-browser controls (XEnroll/CertEnroll and HTML 'keygen' tag).

That's the one I used, and if I recall correctly they sent me an email with a link for me to download the cert. This suggests to me that it was generated server-side and that therefore they could have kept a copy for themselves. But I might be totally wrong on how it works.

I think the free personal certs are server-generated, the business ones are generated client-side.