Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it about handling private keys and certificates.

So this is my perspective of best practices in regards to web servers: When generating private keys it is best to generate them where they will be used and never move them to any other system, if at all possible. From this point generate a CSR from the server with it, to get a signed certificate. At this point the private key is never exposed to anything but the server that originally generated it, therefore there is no chance a hacked laptop or share might expose it.

This makes sense to me, however this security person seems to prefer generating the private key on a system he controls, then transfer this to whatever system needs it. This seems to extend the risk by having the private key in more then one spot as well as a lot more work with no benefit that I can see.

Am I missing anything with this? Other than common practice, is there a reason I am not seeing for this to be done?