How does Let's Encrypt create the private key?

There was a discussion about whether it would be beneficial to have the ACME server contribute entropy to the client (which could then add that entropy to the local RNG pool). I think this discussion was happening inside the ACME working group at IETF, and I don’t know what its result was.

One risk of this approach is that if the client has initialized its RNG with a completely or highly predictable state, the server would then be able to predict what the client’s private key will be. (In some models a network adversary might also be able to do this because the client with a poorly-initialized RNG may not be able to establish a crypto session to the server that successfully conceals the contents of the entropy that the server is providing: the network adversary may be able to infer the value of the session key that protected the entropy download.)