In 'secret' role, use /dev/random by default