How do I use SignedPublicKeyAndChallenge (SPAC) with AD CA? C# or command line?

I need my users to get a local client key for mutual Auth TLS.  How can I parse the SPAC response from the KeyGen HTML element that is supported in Safari, Chrome, and Firefox?

Related links:

http://stackoverflow.com/q/14187373/328397

http://security.stackexchange.com/q/26403/396

http://security.stackexchange.com/q/26148/396