This functionality of replacing urandom is not specific to Kerberos and affects many other programs. I think that this really need to be in a separate module.