The "Enter passphrase" request when manually calling --keygen is optional, not mandatory. If you just leave it blank and proceed it will just create an unencrypted master identity key.
I know, but that requires someone to press enter (or a dirty expect script) if you want to run that non-interactively.
Something like --nopass would be appreciated (if not there yet?).
Maybe not using --keygen in the first place is the workaround here ;) (So I get master keys without passphrase and non-interactively)