Quick $0.02 because I've got to get ready for work:
Assuming this server isn't protecting actual banks or national security-level secrecy, you're fine.
About the only potential risk I can imagine from this is if a hostile third party intercepted enough of those private keys and the exact time they were generated, they could use that to make predictions about the state and algorhithm of the server's random number generator, which might be useful in some very sophisticated attacks.
... Of course, if they can intercept that many of your private keys you have much bigger problems already.
The safest thing to do would be to let the client generate the keypair and use a trusted channel to send you the public key for inclusion into the
authorized_keys file, but if that isn't an option for whatever reason, your main worry is going to be how to securely get the private key to the recipient and only the intended recipient.