Does anyone know how the private key is generated?

I'm really hoping (but really not, for the sake of their customers) that it's something stupid and obvious, like a single SHA256 of the passphrase.