You don't actually have to have writable media on the system itself, as you should in principle be able to pass the entropy information to the system over netbo

You don't actually have to have writable media on the system itself, as you should in principle be able to pass the entropy information to the system over netboot. And now that I think about it, with BIOS being so sophisticated these days (with UEFI and the like), even before booting many systems should be able to use the network to get entropy information. Regarding point (3), if an image is used in a VM, the VM host should be able to pass entropy to the guest, so the guest doesn't have to use its own entropy to boot.