Lots of companies used to allow this, GlobalSign being one of the biggest that jumps to mind (iirc they stopped it in the last couple of months).

The idea that the company would store the private keys, however, is even more troubling.