The in-depth security means you design your system so that it doesn't fall apart if only one of the pieces fall. As for your comment on the PRNG, it's actually

The in-depth security means you design your system so that it doesn't fall apart if only one of the pieces fall. As for your comment on the PRNG, it's actually not a very good design. You would rather use a cipher in stream mode which is indeed fed from a hash, because the cipher will have a better and more predictable behaviour over time. I however don't understand why people were repeating bcrypt as a mantra on your git pull.