/dev/random is working as it should, yes it is safe to generate a key by reading from it; same for
/dev/urandom, which is supposed to be equally safe, and non-blocking, thus always preferable to
However, in practice, it is very easy to make a port of
/dev/random (or its underlying entropy sources) that seems to work, but does not, and will generate the same output (or output with predictable correlation) running on different devices, especially after precisely the same duration since boot. This is one of several possible root causes allowing some recent attacks, and similar to what allowed that one (another possible cause is home-grown RNGs trying to improve
/dev/(u)random, or worse not using it).
So, in particular in a non-mainstream implementation of
/dev/random and its entropy providers, and especially if the context of use makes it likely that the random generation occurs after a short predictable time since boot, do not rely exclusively on
/dev/urandom (which often will collect less actual entropy) without prior review.
Update per otus's comment: In the above I'm thinking of ports on various things with a unix derivative, like embedded development board, set-top box, internet box or appliance, firewall, payment terminal. On mainstream PC linux or unix distributions, especially in user code, I tend to trust
/dev/urandom. I have no informed opinion on Android ports (neither in general, nor the zillions ports to different hardware). Specifically, I'm most worried of the device automatically generating its long-term private key on first boot after setup.