I assumed it didn't, if it did that would be even worse. The problem assuming you trust the creators of that site is that since the connection is unsecured the javascript could be modified for a compromised version w/o you knowing. Even if you watch your connection like a hawk and make sure it doesn't send any data out it could generate a key that might look random but is really based on some shared secret only the attacker knows.