I think that would avoid the potential loophole I was worried about! I'd be careful with the periodicity of the RNG though.

I was on a machine with limited user space. I used OpenSSL, no new binaries, reading and writing at close-to-wire speeds. "Counting zeroes" would track down where they don't match, doesn't it?