Two ways to do it
1) You have a defined position of your antenna... make the ephemeris "work" such that your antenna gets the right signal from the satellite. In a philosophical sense, where is the satellite? Well... does it really matter? This ephemeris says your antenna is in the right place, so...
I'm not implying this is how it work or its a good idea, but it certainly is a good unit test if your "real" method when run thru a test bench implies you're on the moon instead of at the (note singular) base station...
2) Those numbers are no big deal with doppler / frequency ranging. If you transmit at 1500 MHz its a little higher as it approaches and lower as it leaves. Ask a ham radio operator to demonstrate with their 144/440-ish MHz satellites, the doppler in low earth orbit is maybe 15 KHz or so. Anyway sub-Hz accuracy measurement (no big deal) of a 1.5e9 Hz signal for a couple seconds gives you the -11th class of accuracy you're looking for. The absolute freq would be nice to know, but you can figure out the instant the satellite passed zenith (or any other elevation relative to your position) as long as the freq is "short term more or less constant". Of course giant and heavy earth bound clocks can give you that precise freq you're looking for, which is also cool.
The doppler of a satellite pass is pleasingly non-linear and they're high up enough so make for long passes and proper data analysis means you can downsample maybe 10000 samples to find the theoretical best RMS zenith instant for all 10000 samples, so oversampling and averaging gives you another couple orders of magnitude.
Maybe another way to say it, is if you have basically perfect accuracy clocks, and you sample and literally count every incoming cycle of a 1.5e9 RF signal for only 100 seconds even if you ignore phase data (why would you? But for the sake of the argument...) then thats 1.5e11 cycles in a given time, a bit of division and you have a freq accurate to one cycle or part in 10 to the 11th.
Its more complicated in reality because the GPS signal is not a simple RF carrier but is a spread spectrum signal so you need a reasonably low noise and stable PLL to lock onto the SS signal and then you actually measure the SS signal.