But it is written as browser Javascript and is thus totally boned. Here's my attempt to be exhaustive about why:
The passphrase almost certainly doesn't have 1024 bits of entropy in it, and since they describe it as "used to repeatably generate this RSA key", they can't have introduced any additional entropy. And indeed, they just use the SHA256 of the passphrase to seed a PRNG.
They claim that a PublicKeyID "can be used to uniquely identify Sam's public key". Fingerprints help identify keys more easily, but certainly not "uniquely" since they don't have as many bits as the key; pigeonhole principle.
Worse, the PublicKeyID uses MD5.
They use a public exponent of 3, rather than the usual 65537 or larger. It looks like they might protect against small-exponent attacks, but I don't have enough expertise to know that for certain, and in any case this seems like a bad idea.
Neither cryptico nor the rsa-sign library they use mentions anything about HMACs; I haven't dug into the code to figure out if they actually use one or just use a hash directly.
Probably piles more, but I stopped there. :)
Of course, not verifying the padding also means the signatures are straightforward to forge.
(Ping me with a shipping address and I'll send you swag).
One little nitpick:
> What systems programming functionality does Javascript lack?
Here's a starting point: a secure random number generator.
Chrome has actually implemented one (http://blog.chromium.org/2011/06/new-chromium-security-featu...). It's a part of WebKit (http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2011-Feb...).
Firefox has an unimplemented (as of Firefox 6) secure RNG API (https://developer.mozilla.org/en/JavaScript_crypto, https://bugzilla.mozilla.org/show_bug.cgi?id=440046).