> StartSSL doesn't generate it in the browser (on a secure piece of hardware IIRC),

You can also submit a CSR so that key generation happens on your local machine. Only the pubkey and metadata will be included in the CSR and get signed.