We used to have one service account for all instances, but decided a while ago that was a risky strategy. We are now moving to one account per instance, or per pair of instances where we are mirroring databases.

Our Windows Ops team have given us management of an AD group to create these accounts in to.

We do store the passwords for these service accounts, but that's more out of habit than for any specific reason.