Emerton’s answer is, I think, on a less elementary level than that: it’s addressing the case of what $p$-torsion becomes mod $p$. This case is rather simpler: the kernel of the $n$-torsion extends to a smooth finite scheme $G$ over $\mathbb{Z}_{(p)}$. By base changing to the ring of integers of a local field $K$ (with residue field $k$), we know that $G$ is finite smooth free of rank $m$ [in this case $m=n^2$] coprime to $p$ over $O_K$.
Let $C \subset G$ be a closed open subset and let $A=O(C)$ (free $O_K$-algebra of finite rank, with $A \otimes k$ reduced), we want to show that $A$, $A \otimes K$, and $A \otimes k$ have the same idempotents (which will imply the result – as I’ll explain afterwards).
The bijection from the idempotents of $A$ to the idempotents of $A \otimes k$ is well-known (it’s basically Hensel). The inclusion from the idempotents of $A$ to those of $A \otimes K$ is clearly well-defined and injective. But if $e \in A\otimes K$ is idempotent, then for some $a \in O_K$ (a power of the uniformizer, chosen to be minimal – suppose for the sake of contradiction that $a$ is noninvertible) $e’=ae \in A$ and $e’^2=ae’$. But this means that $e’^2$ vanishes in $A \otimes k$ so $e’$ was already divisible in $A$ by the uniformizer, so we could have chosen $a$ with a smaller valuation!
Why is this enough? Well, consider the residue disk $C$ of the unit point in the special fiber of $G$: $G$ is finite as a topological space, so it is the finite reunion of closures of points on the generic fiber, so $C$ is closed. But $G$ is finite as a topological space, so $C$ is constructible. Since $C$ is of course stable under generization, so $C$ is open.
So $C$ is a closed open subscheme of $G$ with its special fiber reduced to a point, so by the above its generic fiber must be connected. But $C$ is smooth over $O_K$ so its generic fiber is the spectrum of a finite reduced, connected $K$-algebra with a $K$-point (the unit), so it must be $K$, ie reduced to a point, so we are done.
Note that $E[p]$ is an affine scheme, so $E[p] \cong \operatorname{Spec} A$ for some commutative ring $A$, and then $H^0(E[p], \mathcal{O}_{E[p]}) \cong A$. Moreover, $E[p]$ is zero-dimensional, and, since $K$ has characteristic zero, $E[p]$ is also a reduced scheme. Zero-dimensional reduced schemes of finite type over a field $K$ have a very simple description: they're the spectra of étale $K$-algebras, that is, finite products of finite separable extensions of the base field $K$.
Here's what that looks like in this case: $E[p](\bar{K}) \cong (\mathbb{Z}/p\mathbb{Z})^2$ consists of $p^2$ points, and these points are partitioned into Galois orbits by the action of the absolute Galois group $\operatorname{Gal}(\bar{K}/K)$. The points of the scheme $E[p]$ correspond to these Galois orbits, and the residue field of each point is the field of definition of the coordinates of one of the $\bar{K}$-points in the corresponding orbit. So, $E[p](\bar{K}) \cong \operatorname{Spec}(L_1 \times \ldots \times L_n)$, where $L_1, \ldots, L_n$ are finite separable extensions of $K$. (Actually, "separable" is redundant since all algebraic extensions are separable in characteristic zero.)
It may help to illustrate with a few examples:
- Elliptic curve 24.a3, given by the equation $y^2 = x^3-x^2-24x-36 = (x - 6) (x + 2) (x + 3)$, has all four of its $2$-torsion points defined over $\mathbb{Q}$, so $H^0(E[2], \mathcal{O}) \cong \mathbb{Q}^4$.
- Elliptic curve 20.a1, given by the equation $y^2=x^3+x^2-41x-116 = (x + 4) (x^2 - 3x - 29)$, has two $2$-torsion points defined over $\mathbb{Q}$: the point at infinity and $(-4, 0)$. The other two $2$-torsion points are a conjugate pair defined over $\mathbb{Q}(\sqrt{5})$, over which $x^2 - 3x - 29$ factors. Thus, the ring of global sections of $E[2]$ is $\mathbb{Q}^2 \times \mathbb{Q}(\sqrt{5})$.
- Elliptic curve 88.a1, given by the equation $y^2=x^3-4x+4$, has no $2$-torsion points defined over $\mathbb{Q}$ except the point at infinity. The other three $2$-torsion points are defined over number field 3.1.44.1, the cubic field $K$ generated by adjoining a root of $x^3 - 4x + 4$. So here the ring of global sections of $E[2]$ is isomorphic to $\mathbb{Q} \times K$. (Note that we take the field $K$ itself here, not its sextic splitting field over which all four $2$-torsion points can be defined simultaneously.)
In positive characteristic $\ell \neq p$, the same is true—the scheme $E[p]$ is a reduced zero-dimensional scheme of length $p^2$—except that now we really do need to say "separable". In characteristic $p$, the situation is more complicated: $E[p]$ is no longer a reduced scheme, so its ring of global sections isn't a reduced $K$-algebra, and we have two very different cases depending on whether $E$ is an ordinary or supersingular elliptic curve.
Best Answer
What's going on is that what you thought was true is wrong. The intersections of lines used to define the group law on an elliptic curve can be written in coordinates using division only by expressions which are units modulo the equation of the curve (this is not obvious and takes some work to prove, and this work is a crucial part of proving that an elliptic curve actually is a group scheme). As a result, they make sense over any algebra over your base ring (see below).
There's also a small but important error in your first set of statements. We normally talk about group schemes over some base ring $A$ (or more generally, over some base scheme). In that case, all our functors are on the category of $A$-algebras, not on the category of commutative rings. Of course, one case of this is $A=\mathbb{Z}$ where you really would get commutative rings, but there actually are no elliptic curves over $\mathbb{Z}$ by a theorem of Tate (in case this seems obviously wrong to you, keep in mind that the definition of an elliptic curve requires nonsingularity, and over $\mathbb{Z}$ that means that the reductions mod $p$ need to be nonsingular for every prime $p$). In any case, it is most common to talk about elliptic curves over some field $k$, so our functors would be on the category of $k$-algebras.