The certificate doesn't belong to any one specific TrustedForm account. Furthermore, anyone that handles the lead data can see the certificate, even if they don't have a TrustedForm account, for 3 days after the certificate is generated. Certificates look the same to account holders and non-account holders. Everyone is privy to the exact same information. If you have the lead data, then you have the certificate URL, and therefore can see the information exposed by TrustedForm. Transparency is paramount.
For a full overview of the concept of 'Certificate of Authority', please click here.