Can paralegals and others who are not holders of PKI certificates file patent applications on behalf of the certificate holder using EFS-Web?

Yes. A PKI (Public Key Infrastructure) certificate is a digital certificate issued by the USPTO to registered patent attorneys, registered patent agents, independent inventors, and limited recognition practitioners.