web3.personal.newAccount(<password>), using IPC on the local Ethereum node. However, the keys would be generated on the Ethereum node and would have to be managed by the web application.
Is there another way to do this such that the key-pair is generated on the user's machine so that the private key remains exclusively with the user? One way could be by using MetaMask, which (I have read) is a Chrome extension that "injects web3" into the browser. That would make it possible to generate keys on the user's machine. MetaMask would also be needed later for user to send signed transactions because the signing has to be done on the user side. Would that also be mean that the signed transaction would be sent directly from browser to the Ethereum node by calling
web3 being provided by MetaMask) and not via the web application as a proxy ?
But then all this would force the user to use the Chrome browser and have the MetaMask extension installed. Is there a way to remove this limitation? Or is it true that a web application (i.e. running on a centralized server) that lets remote users create Ethereum accounts has to manage the keys itself?