Hacker News Reader

Their FAQ implies they do it the usual way: "The sslmate command generates a 2048 bit RSA key."

Which is good, as sending you a key would be egregious incompetence from a cert vendor.

Egregious, perhaps, but not unheard of.

They don't actually generate the key on the server but use the keygen element. This generates a key in the browser and doesn't send it to the server.