Well yes you would generate the number those ways. The keylogger defence is actually in the random subset of numbers asked for. It completely destroys any attack it could make by never giving it a single complete picture :-)