I can confirm that versions 0.9.3-1 and 10.0.0-2 use /dev/urandom to generate keys, I checked with strace:
$ strace -o /tmp/xca.log xca Opening database: /tmp/test.xdb [generate key] $ grep random /tmp/xca.log open("/dev/urandom", O_RDONLY) = 13 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 13 -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org