I'm not sure it is quite that bad: iirc, the only time there's a `&mut` to the interior (i.e. a `&mut` that can alias) is inside `next_u32,` `next_u64` and the bytes one, and none of these allow for external code, that is, there's no way to have nested calls (e.g. the `RefCell` will never fail a borrow check).

In any case its definitely worth documenting that `TaskRng` needs to stay this way: being very careful to hand out its interior (it might even be worth putting it into its own module and reexport the struct, so privacy helps stops people doing bad things accidentally).

(I'm on my phone ATM, so I can't actually check if this true.)