Author here: if people aren't familiar with webcrypto (<a href="https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...</a>) it's a way to do real crypto, using the OS and openssl / boringssl (Google's openssl fork). I.e., it's not 'JavaScript crypto', but actually has proper randomness, hence properly unguessable keys. When we make keypairs with webcrypto, the private key never leaves the browser, so CertSimple doesn't know it.<p>That said, if a user prefers to make keys on their own machine we create a custom bash / powershell script to create the necessary CSR and private key in a single paste - no clicking, no Q and A, and without installing anything.