The only thing that is Megabad in there is using math.random to generate random data for the RSA key generation. That means they are dependent on the browser ve

The only thing that is Megabad in there is using math.random to generate random data for the RSA key generation. That means they are dependent on the browser vendor to provide a sufficiently good PRNG, now and in the future. Seems like it might have been wiser for them to implement one, though it might be difficult to get good sources of entropy from Javascript.