I don't like including the CSPRNG here. It feels like cheating. But others who have wrangled with this problem also suggest it. So for now it stays.