XOR the resulting thread keys onto out, so we can easily prove that the output is as hard to distinguish from truly random as SHA-256 output