[Cryptography] Entropy Needed for SSH Keys?

[Kent Borg]

Embedded devices are frequently starved for entropy, and frequently want 
to generate SSH keys on first boot when the entropy might be in 
particularly short supply.

How much entropy does modern openssh key generation need?

In a case I am playing with I want my own 512-bits of entropy after the 
ssh keys are generated. If I can come up with a nice plump 4096-bits at 
boot (common pool size these days for Linux urandom), and then generate 
the ssh keys, how many bits will be left over?

This might be an elementary question, but embedded people are always 
getting this stuff terribly wrong, so my excuse is that a little 
repetition is good.

Thanks,

-kb