The privacy concern about sending pass data to the server is valid though. Since .pkpass files need to be cryptographically signed with Apple's certificate, there's no way to generate them purely client-side.
Potential solution: open source the signing code and let users run it locally with their own Apple Developer account ($99/year). Power users would do this, casual users can use your hosted version.
Also works with Google Wallet apparently, which is great for Android users.