Low-order bits from sufficient timing measurements would be effectively random. You're not looking at the characters, you're looking at the intervals between keypresses, and gathering the least significant digits of those. This is what PGP/GPG use for gathering entropy when generating keys as well.

Not saying that's what's being done here, but it's a way to take fairly nonrandom activity and get decent entropy from it.