Besides that they might be breaking laws in other ways, there is a normal (used by card perso bureaus) procedure for the concern about them generating the priva

Besides that they might be breaking laws in other ways, there is a normal (used by card perso bureaus) procedure for the concern about them generating the private keys. I doubt they use that, but he. It would be a closed system which automatically, using an HSM usually, generates all required secrets and adds them on the stick and then destroys them. To make it be more robust, it would include a procedure which, again automatically and not accessible (by procedural regulation; this is all not technical really) by humans, generates a keypair, somehow provides the private key to the user (email? preferably the user would generate the keypair but if you have to buy these sticks we cannot expect them to?) before destroying it and encrypt the stick content with the pubkey. Some auditor would review the process, software and hardware and put a stamp on it to close off that liability. In this case, the empty usb sticks go into the blackbox (regulatory and possibly also technically) and come out with unreadable content, so who handles them after is no longer relevant for security. If these guys sit behind their normal work laptops, connected to the interwebs, generating these sticks and sending them off unencrypted, you probably will have a lot of issues if someone comes to look at your operation.