One of those days where ten hours of coding amount to... 135 lines. To be fair, in the second most scary part of the Go crypto standard library: crypto/rand.

If this breaks, everything breaks. (ECDSA nonce generation is still scarier, at least this has tests.)

Rewrote most of it to be much simpler and error-free, and made rand.Read crash the program if (impossible) errors occur.

Even found a bug in the old code masked by the urandom fallback. Also, no more allocations! https://go.dev/cl/602495