Just to be pedantic here, I can think of one way that is completely firewalled. You build your own computer using old-skool pre-internet technology (or just dig out that old ZX-Spectrum from the attic) to be sure there are no NSA infected parts inside, code up your own address generator from scratch (I take it you're allowed to refer to the online wallet code and algorithm documentation, perhaps print it out at your local library), make a nice hot cup of tea (it will make a good source of entropy for your hardware RNG), then Bob's your maiden aunt.