How do I use SignedPublicKeyAndChallenge (SPAC) with AD CS? C# or command line?

I'm posting a AD CS question here because I can't find the right forum.  Please redirect me if you know of a better spot.

I need my users to get a local client key for mutual Auth TLS.  How can I parse the SPAC response from the KeyGen HTML element that is supported in Safari, Chrome, and Firefox?

Related links:

http://stackoverflow.com/q/14187373/328397

http://security.stackexchange.com/q/26403/396

http://security.stackexchange.com/q/26148/396