Unlike crypto_sign_keypair() calls randombytes()
so it is not guaranteed to be thread-safe (for now).