Kernel.rand nearly passes the spec

But it's not private yet.