refine the warning logic; previous behaviour was too spammy

- separate the "make sure we have strong rng" logic away from "warn about system rng"
- limit the number of "system rng only" warnings to 20
- tweak error messages to be more consistent and shorter