I get why 'SIV' used a hash of the message in addition to the user provided nonce. My point was I disagree on your sentence "the best way to generate a unique

I get why 'SIV' used a hash of the message in addition to the user provided nonce. My point was I disagree on your sentence "the best way to generate a unique nonce is as a hash of the input message - otherwise you technically have to record every nonce you’ve ever used." That implies that a hash is strong enough that you don't need to track messages. If you believe that to be the case then a CSRNG would be equally as strong of not stronger and less complex. Still sqrt(n) chance of collision.