Except 99% of one-time pad implementations fail in at least one criteria: * Using CSPRNGs instead of HWRNGs to generate the pads, * Try to make it usable and

Except 99% of one-time pad implementations fail in at least one criteria: * Using CSPRNGs instead of HWRNGs to generate the pads, * Try to make it usable and share short entropy and reinvent stream ciphers, * Share that short entropy over Diffie-Hellman RSA, * Fail to use unconditionally secure message authentication, * Re-use pads, * Forget to overwrite pads, * Fail to distribute pads off-band via sneakernet or dead drops or QKD. OTP is also usually the first time someone dabbles in creating cryptographic code so the implementations are full of footguns.