Comment by seanhunter

> The nice thing about a secure XOF is that it doesn’t matter if the entropy given to the XOF is less than perfect. If an XOF is given 10 different sources of entropy, and only one of them is secure, the XOF will remain secure. [1]

Isn’t that also true of the cryptographic sponge function that is used to implement /dev/{,u}random?