Private key generation bitaddress.org vs application wallet (armory / bitcoin-qt) Is an application like armory or bitcoin-qt more secure/ trustable in generating the public and private keys than a locally installed version of bitaddress.org ?
There are different issues with generating cryptographic keys in general (including private keys for bitcoin) on a downloaded client versus a client served online, as bitaddress.org does. However, I think you yourself should be the judge of what is &quot;more trustable.&quot; Here are the issues:

Code integrity
The problem in both cases is if your client is trustworthy, or possibly compromised. There are many aspects to this question, including if you trust the original programmer to get everything right, and not actually put in some bitcoin-stealing spyware. Possibly more interesting is the question if you would detect it if somebody (maybe a cybercriminal?) were to alter the code before you execute it. For downloadable clients, the question is basically if you check its integrity by comparing its checksum with what is published by a reputable source. This gives some security if you do, and if you trust whatever source you may get the checksum from, but in the end, even if you do, it essentially boils down to, at best, trusting whatever entity compiled the client for you. For the web-served javascript program from bitaddress.org, you do not even get a chance to check it yourself---meaning you absolutely have to trust its operator (and possibly the NSA) to serve an uncompromised program.

Quality of random number generator
Any private key is generated from randomness. If too much of it were predictable, that would defeat its ability to remain a secret. And that's the weak spot, because many computers in actual use are not too good at generating random numbers, either because they do not have a dedicated source of randomness built-in, or because the software used does not have access to it. With a computer you use interactively, you should be mostly fine, because timing jitter in your key presses, mouse motion, etc., is typically used to harvest strongly random numbers. A well-written downloadable client should have access to such facilities via your operating system and, typically, the SSL libraries---and yet, in practice, a lot of weak implementations have been found, including in a mainstream Linux distribution years back and, recently, in the Android operating system, actually affecting Bitcoin key generation. See the Guardian's article about Google confirming the problem. Any javascript implementation, like bitaddress.org, may be both worse and better off by having less direct access to such random number facilities.

Execution environment
Could any malware you might unwittingly have on your computer interfere, either spying on your keys or by weakening the keys your generate? For the downloadable client, we are essentially talking about vulnerabilities of your OS (plus your usage of your computer). For the javascript-based bitaddress.org, some vulnerabilities of your web browser that &quot;only&quot; allow interfering with something inside the browser might pose additional risk.

Opportunity and effort vs. reward trade-off for an adversary
Sometimes it is more dangerous to go the same route as everybody else by presenting, collectively, a larger incentive to exploit this route. Sometimes it could be more dangerous to do the opposite and possibly ending up using a solution that has received less public scrutiny and might, without one's knowledge, contain critical vulnerabilities.