The big advantage of implicit certificate is their small size and fast processing. This article presents a way how to compute implicit certificates.
In the end Alice is able to derive both her public and private key ($\alpha$, $Q_A$).
Does this mean that the usage of implicit certificates implies the generation of a new key pair each time such a certificate is issued? Traditional explicit certificates (e.g. X.509) can be issued unlimited often for the same public key.
How do you prevent somebody else to derive Alice's private key? I don't see any secret information that is only possessed by Alice. Initially, I thought this was $\alpha$, but apparently this random integer is send in plain text to the CA. Even if it was encrypted, the CA would know $\alpha$ and consequently Alice's private key.