> When I got my cert from COMODO as outlined above the file was saved from the web browser to my downloads file. This struck me as odd. Does this mean they could have copy of my cert?

There are client-side APIs (e.g. Blob+<a download> or FileSaver.js) for saving locally generated files from JS, though I have no idea if COMODO uses them.