I’d want to know more about it and whether it’s generated in the browser or on the server.

FWIW, most of these web-based Nostr clients are just static JS files. They’re SPAs that connect to the relay servers (via WebSocket, IIRC). You can open up your browser’s devtools, go to the “Network” tab, and see what’s happening.

I don’t think I’d trust one that does any server-side rendering. No particular reason (though I’m sure I could think of some) other than it just wouldn’t feel right for Nostr.

I’m also not even sure how I’d go about doing some sort of review of the javascript algorithms or where their random numbers come from

I’d guess they just use the native WebCrypto APIs, but I have not verified. More info on native crypto APIs available in JS here:

• https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
• https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API

(FWIW, every Node.js distro I’ve ever used leveraged OpenSSL for those, under the hood. I imagine other runtimes do too.)