Fix RNG for bootloader and make insecure PRNG opt-in, not opt-out.