@AliceWonder, our key generation in the client is
key = OpenSSL.crypto.PKey()
/dev/urandom on the host system. We don’t think that we have expertise that would make users safer by tampering with the entropy sources for key generation instead of using OpenSSL defaults.
If users have specific requirements about entropy sources, they are definitely welcome to use daemons that seed the local kernel CSPRNG differently or modify their OpenSSL behavior to use different or additional sources. Our intuition is that nothing that we know how to do or suggest is guaranteed to make things better in this area. (If anybody thinks they have a generally-applicable improvement for key generation behavior, the OpenSSL project is a better project to propose it to.)