That multiplying two floats idea is clever. You could use two random double floats (2*64 bits = 128 bits). It would be extremely unlikely that they are found by accident and just running javascript in the browser could leak AES keys.