[proofplan]
After restricting the global Galois representation to a decomposition group at $p$, the [Neron-Ogg-Shafarevich criterion](/theorems/???) identifies good reduction with unramified $\ell$-adic Tate-module action. The Lefschetz trace formula is applied on the smooth special fibre using geometric Frobenius on étale cohomology; the comparison between $H^1_{\mathrm{et}}$ and the Tate module identifies this cohomological operator with arithmetic Frobenius on $V_\ell E$. The Weil pairing computes the determinant as the cyclotomic character evaluated at arithmetic Frobenius. Since $V_\ell E$ is two-dimensional over $\mathbb{Q}_\ell$, trace and determinant determine the displayed characteristic polynomial.
[/proofplan]
[step:Use good reduction to make the Tate module unramified at $p$]
Fix an embedding $\overline{\mathbb{Q}} \hookrightarrow \overline{\mathbb{Q}}_p$, and let $D_p \subset \operatorname{Gal}(\overline{\mathbb{Q}}/\mathbb{Q})$ be the corresponding decomposition group at $p$, identified with $\operatorname{Gal}(\overline{\mathbb{Q}}_p/\mathbb{Q}_p)$. Let $I_p \subset D_p$ denote the inertia subgroup, namely the kernel of the natural reduction map $D_p \to \operatorname{Gal}(\overline{\mathbb{F}}_p/\mathbb{F}_p)$. Let $\mathcal{E}/\mathbb{Z}_p$ denote the [Néron model](/page/Neron%20Model) of $E$ over $\mathbb{Z}_p$, and let $\widetilde{E}/\mathbb{F}_p$ denote its smooth special fibre. Since $E$ has good reduction at $p$, $\widetilde{E}$ is an elliptic curve over $\mathbb{F}_p$, and the [Neron-Ogg-Shafarevich criterion](/theorems/???) gives that the prime-to-$p$ torsion of $E$ specializes isomorphically to the prime-to-$p$ torsion of $\widetilde{E}$. In particular, for every integer $n \geq 1$, specialization gives an isomorphism of $\operatorname{Gal}(\overline{\mathbb{F}}_p/\mathbb{F}_p)$-modules
\begin{align*}
E[\ell^n](\overline{\mathbb{Q}}_p) \cong \widetilde{E}[\ell^n](\overline{\mathbb{F}}_p).
\end{align*}
The inertia subgroup $I_p$ acts as the identity on the residue field $\overline{\mathbb{F}}_p$, hence acts as the identity on $\widetilde{E}[\ell^n](\overline{\mathbb{F}}_p)$ for every $n$. Passing to the inverse limit over $n$ gives identity action of $I_p$ on the [$\ell$-adic Tate module](/page/Tate%20Module)
\begin{align*}
T_\ell E := \varprojlim_{n} E[\ell^n](\overline{\mathbb{Q}}_p),
\end{align*}
and tensoring with $\mathbb{Q}_\ell$ gives identity action of $I_p$ on $V_\ell E$. Thus the restriction of $\rho_{E,\ell}$ to $D_p$ factors through $D_p/I_p$, so $\rho_{E,\ell}$ is unramified at $p$.
[guided]
Fix an embedding $\overline{\mathbb{Q}} \hookrightarrow \overline{\mathbb{Q}}_p$, and let $D_p \subset \operatorname{Gal}(\overline{\mathbb{Q}}/\mathbb{Q})$ be the corresponding decomposition group at $p$. Through this embedding we identify $D_p$ with $\operatorname{Gal}(\overline{\mathbb{Q}}_p/\mathbb{Q}_p)$. Let $I_p \subset D_p$ be the inertia subgroup, defined as the kernel of the reduction map $D_p \to \operatorname{Gal}(\overline{\mathbb{F}}_p/\mathbb{F}_p)$. The point of good reduction is that the $\ell$-power torsion, with $\ell \neq p$, survives reduction without losing information. Let $\mathcal{E}/\mathbb{Z}_p$ be the [Néron model](/page/Neron%20Model) of $E$, and let $\widetilde{E}/\mathbb{F}_p$ be its special fibre. The hypothesis of good reduction means precisely that $\widetilde{E}$ is a smooth elliptic curve over $\mathbb{F}_p$.
For every integer $n \geq 1$, the specialization map identifies the finite group scheme of $\ell^n$-torsion on the generic fibre with the corresponding $\ell^n$-torsion on the special fibre:
\begin{align*}
E[\ell^n](\overline{\mathbb{Q}}_p) \cong \widetilde{E}[\ell^n](\overline{\mathbb{F}}_p).
\end{align*}
The condition $\ell \neq p$ is used here: multiplication by $\ell^n$ is étale on the smooth group scheme, so the $\ell^n$-torsion is finite étale and specializes well.
The inertia subgroup $I_p$ is the subgroup of local Galois elements acting as the identity on the residue field. Therefore, after the above specialization identification, every element of $I_p$ acts as the identity on $\widetilde{E}[\ell^n](\overline{\mathbb{F}}_p)$, hence as the identity on $E[\ell^n](\overline{\mathbb{Q}}_p)$. Taking the inverse limit over $n$ gives identity action on
\begin{align*}
T_\ell E := \varprojlim_n E[\ell^n](\overline{\mathbb{Q}}_p),
\end{align*}
and tensoring with $\mathbb{Q}_\ell$ gives trivial action on
\begin{align*}
V_\ell E := T_\ell E \otimes_{\mathbb{Z}_\ell}\mathbb{Q}_\ell.
\end{align*}
Thus the representation factors through
\begin{align*}
\operatorname{Gal}(\overline{\mathbb{Q}}_p/\mathbb{Q}_p)/I_p \cong \operatorname{Gal}(\overline{\mathbb{F}}_p/\mathbb{F}_p),
\end{align*}
which is exactly the assertion that $\rho_{E,\ell}$ is unramified at $p$.
[/guided]
[/step]
[step:Compute the Frobenius trace from the point count]
Let
\begin{align*}
H^1_\ell(\widetilde{E}) := H^1_{\mathrm{et}}(\widetilde{E}_{\overline{\mathbb{F}}_p}, \mathbb{Q}_\ell)
\end{align*}
be the first étale cohomology group of the special fibre, and let $\Phi_p$ denote geometric Frobenius on $\widetilde{E}_{\overline{\mathbb{F}}_p}$. The [Lefschetz trace formula](/theorems/???) for the smooth proper curve $\widetilde{E}/\mathbb{F}_p$ gives
\begin{align*}
|\widetilde{E}(\mathbb{F}_p)|
=
\operatorname{Tr}(\Phi_p^* \mid H^0_{\mathrm{et}})
-
\operatorname{Tr}(\Phi_p^* \mid H^1_\ell(\widetilde{E}))
+
\operatorname{Tr}(\Phi_p^* \mid H^2_{\mathrm{et}}).
\end{align*}
Here $\Phi_p^*$ acts on $H^0_{\mathrm{et}}$ with trace $1$ and on $H^2_{\mathrm{et}} \cong \mathbb{Q}_\ell(-1)$ with trace $p$. Since good reduction gives $|\widetilde{E}(\mathbb{F}_p)| = |E(\mathbb{F}_p)|$, the formula becomes
\begin{align*}
|E(\mathbb{F}_p)|
=
1
-
\operatorname{Tr}(\operatorname{Frob}_p \mid H^1_\ell(\widetilde{E}))
+
p.
\end{align*}
Therefore
\begin{align*}
\operatorname{Tr}(\Phi_p^* \mid H^1_\ell(\widetilde{E}))
=
p + 1 - |E(\mathbb{F}_p)|
=
a_p.
\end{align*}
The comparison isomorphism
\begin{align*}
H^1_{\mathrm{et}}(\widetilde{E}_{\overline{\mathbb{F}}_p},\mathbb{Q}_\ell) \cong \operatorname{Hom}_{\mathbb{Q}_\ell}(V_\ell E,\mathbb{Q}_\ell)
\end{align*}
is contravariant in $\widetilde{E}$. Therefore pullback by geometric Frobenius on cohomology is the dual [linear map](/page/Linear%20Map) to the arithmetic Frobenius action on $V_\ell E$. A linear map and its dual have the same trace, so
\begin{align*}
\operatorname{Tr}(\rho_{E,\ell}(\operatorname{Frob}_p) \mid V_\ell E)=a_p.
\end{align*}
[guided]
We now extract the trace from the number of points on the reduced curve. Define
\begin{align*}
H^1_\ell(\widetilde{E}) := H^1_{\mathrm{et}}(\widetilde{E}_{\overline{\mathbb{F}}_p}, \mathbb{Q}_\ell),
\end{align*}
and let $\Phi_p$ denote geometric Frobenius on $\widetilde{E}_{\overline{\mathbb{F}}_p}$. This convention matters: the [Lefschetz trace formula](/theorems/???) counts $\mathbb{F}_p$-points using geometric Frobenius on étale cohomology. The smooth proper curve $\widetilde{E}/\mathbb{F}_p$ satisfies the hypotheses of the trace formula because it is smooth, proper, and defined over the finite field $\mathbb{F}_p$. The formula expresses the number of rational points as an alternating sum of geometric Frobenius traces:
\begin{align*}
|\widetilde{E}(\mathbb{F}_p)|
=
\operatorname{Tr}(\Phi_p^* \mid H^0_{\mathrm{et}})
-
\operatorname{Tr}(\Phi_p^* \mid H^1_\ell(\widetilde{E}))
+
\operatorname{Tr}(\Phi_p^* \mid H^2_{\mathrm{et}}).
\end{align*}
For a geometrically connected smooth proper curve, $H^0_{\mathrm{et}}$ is one-dimensional and $\Phi_p^*$ acts as the identity, so the first trace is $1$. For an elliptic curve, $H^2_{\mathrm{et}} \cong \mathbb{Q}_\ell(-1)$ is one-dimensional and geometric Frobenius acts on it with trace $p$. Hence
\begin{align*}
|\widetilde{E}(\mathbb{F}_p)|
=
1
-
\operatorname{Tr}(\operatorname{Frob}_p \mid H^1_\ell(\widetilde{E}))
+
p.
\end{align*}
Because $E$ has good reduction at $p$, the notation $E(\mathbb{F}_p)$ means the $\mathbb{F}_p$-points of the smooth reduction $\widetilde{E}$, so
\begin{align*}
|\widetilde{E}(\mathbb{F}_p)| = |E(\mathbb{F}_p)|.
\end{align*}
Solving the trace formula for the middle trace gives
\begin{align*}
\operatorname{Tr}(\Phi_p^* \mid H^1_\ell(\widetilde{E}))
=
p + 1 - |E(\mathbb{F}_p)|
=
a_p.
\end{align*}
Finally we connect this cohomological trace to the Galois representation in the statement. The comparison isomorphism
\begin{align*}
H^1_{\mathrm{et}}(\widetilde{E}_{\overline{\mathbb{F}}_p},\mathbb{Q}_\ell) \cong \operatorname{Hom}_{\mathbb{Q}_\ell}(V_\ell E,\mathbb{Q}_\ell)
\end{align*}
is contravariant in the curve. Under this identification, pullback by geometric Frobenius on cohomology is the dual linear map to arithmetic Frobenius acting on $V_\ell E$. Dual linear maps have the same trace as the original linear maps, because their matrices are transposes after choosing a basis. Thus
\begin{align*}
\operatorname{Tr}(\rho_{E,\ell}(\operatorname{Frob}_p) \mid V_\ell E) = a_p.
\end{align*}
[/guided]
[/step]
[step:Compute the Frobenius determinant from the Weil pairing]
For every integer $n \geq 1$, the [Weil pairing](/page/Weil%20Pairing) is a perfect alternating pairing
\begin{align*}
e_{\ell^n}: E[\ell^n] \times E[\ell^n] \to \mu_{\ell^n}.
\end{align*}
It is Galois equivariant: for every $\sigma \in \operatorname{Gal}(\overline{\mathbb{Q}}/\mathbb{Q})$ and every $P,Q \in E[\ell^n]$,
\begin{align*}
e_{\ell^n}(\sigma P,\sigma Q)=\sigma(e_{\ell^n}(P,Q)).
\end{align*}
Passing to the inverse limit and then tensoring with $\mathbb{Q}_\ell$ gives the [Weil-pairing determinant formula](/theorems/???): the determinant of the action on $V_\ell E$ is the [$\ell$-adic cyclotomic character](/page/Cyclotomic%20Character):
\begin{align*}
\det(\rho_{E,\ell}(\sigma)) = \chi_\ell(\sigma).
\end{align*}
Arithmetic Frobenius at $p$ acts on $\ell$-power roots of unity by
\begin{align*}
\zeta \mapsto \zeta^p,
\end{align*}
so
\begin{align*}
\chi_\ell(\operatorname{Frob}_p)=p.
\end{align*}
Therefore
\begin{align*}
\det(\rho_{E,\ell}(\operatorname{Frob}_p) \mid V_\ell E)=p.
\end{align*}
[guided]
The determinant is controlled by the Weil pairing. For each integer $n \geq 1$, define
\begin{align*}
e_{\ell^n}: E[\ell^n] \times E[\ell^n] \to \mu_{\ell^n}
\end{align*}
to be the Weil pairing, where $\mu_{\ell^n}$ is the group of $\ell^n$-th roots of unity in $\overline{\mathbb{Q}}$. This pairing is perfect and alternating, so it identifies the determinant of the Galois action on the two-dimensional $\ell^n$-torsion with the Galois action on $\mu_{\ell^n}$.
More explicitly, Galois equivariance says that for every $\sigma \in \operatorname{Gal}(\overline{\mathbb{Q}}/\mathbb{Q})$ and every $P,Q \in E[\ell^n]$,
\begin{align*}
e_{\ell^n}(\sigma P,\sigma Q)=\sigma(e_{\ell^n}(P,Q)).
\end{align*}
If $\sigma$ acts on $E[\ell^n]$ by a matrix $A_n \in GL_2(\mathbb{Z}/\ell^n\mathbb{Z})$ after choosing a basis, then the alternating nature of $e_{\ell^n}$ implies that the left-hand side multiplies the pairing by $\det A_n$. The right-hand side is multiplication by the cyclotomic character modulo $\ell^n$. Hence
\begin{align*}
\det A_n \equiv \chi_\ell(\sigma) \pmod{\ell^n}.
\end{align*}
Passing to the inverse limit over $n$ gives
\begin{align*}
\det(\rho_{E,\ell}(\sigma)) = \chi_\ell(\sigma)
\end{align*}
on $T_\ell E$, and the same equality holds after tensoring with $\mathbb{Q}_\ell$.
Now take $\sigma=\operatorname{Frob}_p$, where $\operatorname{Frob}_p$ denotes arithmetic Frobenius in $D_p/I_p$. Arithmetic Frobenius acts on every $\ell^n$-th root of unity $\zeta \in \mu_{\ell^n}$ by
\begin{align*}
\zeta \mapsto \zeta^p.
\end{align*}
Therefore the cyclotomic character satisfies
\begin{align*}
\chi_\ell(\operatorname{Frob}_p)=p,
\end{align*}
and consequently
\begin{align*}
\det(\rho_{E,\ell}(\operatorname{Frob}_p) \mid V_\ell E)=p.
\end{align*}
[/guided]
[/step]
[step:Assemble trace and determinant into the characteristic polynomial]
The $\mathbb{Q}_\ell$-[vector space](/page/Vector%20Space) $V_\ell E$ has dimension $2$. Let
\begin{align*}
A := \rho_{E,\ell}(\operatorname{Frob}_p) \in GL(V_\ell E).
\end{align*}
For a linear endomorphism of a two-dimensional vector space,
\begin{align*}
\det(1-XA \mid V_\ell E)
=
1-\operatorname{Tr}(A \mid V_\ell E)X+\det(A \mid V_\ell E)X^2.
\end{align*}
Using the trace computation
\begin{align*}
\operatorname{Tr}(A \mid V_\ell E)=a_p
\end{align*}
and the determinant computation
\begin{align*}
\det(A \mid V_\ell E)=p,
\end{align*}
we obtain
\begin{align*}
\det\left(1-X\rho_{E,\ell}(\operatorname{Frob}_p)\mid V_\ell E\right)
=
1-a_pX+pX^2.
\end{align*}
This proves the asserted Frobenius polynomial.
[/step]
