Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs.
With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server.
From the documentation at:
it appears that Amazon generates the keypair on their servers and sends you the private key via HTTPS. This is perhaps less than perfect (ideally, you and no one else will have possession of the private key), but probably not terribly so, given that this all occurs in the context of your authenticated session and only you (and Amazon temporarily) see the private key. You can also always generate and upload your own public key for EC2 use, while keeping the private key strictly private.
For setting up SFTP users for key authentication, they should be generating SSH keys on their machines. Once they generate a key pair, they should only be sending you the public key to install in the relevant authorized_keys file. The private key, as the name implies, is private.