Above you say it should be randomly generated, but then you use a fixed key that obviously isn't.

Maybe this should say `os.urandom`?