And? The fact of the matter is, there's no workable alternative. You either have a good source of entropy, or you don't. If you don't, people aren't going to st

And? The fact of the matter is, there's no workable alternative. You either have a good source of entropy, or you don't. If you don't, people aren't going to stop using things like OpenSSH. If a box is blocked on boot that's universally considered broken and everybody will try to work around it. Fortunately in practice the situation isn't so dire. There are usually multiple hardware RNGs on a system. They may be all untrusted, but I'll trust them together before I'll ever trust the strength (and persisting correctness) of guesstimators. Ironically, entropy guesstimators are predicated on the very notion that the hardware is benign. Malicious hardware could implement subtle timing patterns in interrupts, much like what they might do for an actual RNG (e.g. use an AES encryption function to "randomize" their visible behavior). And in any event, you can still mix various system timing events into your pool without pretending you can quantitatively and reliably know their entropic contribution.