How about XOR-ing output from some promising hardware generator with SHA256(SHA256("user-supplied random nonsense phrase"))? This way we ensure against both att

How about XOR-ing output from some promising hardware generator with SHA256(SHA256("user-supplied random nonsense phrase"))? This way we ensure against both attacks (or backdoors) in hardware and bruteforcing user input. Generally speaking, if we have 2 to 4 independent sources of random numbers (/dev/random, user input, external generator, something else), what's the best way to combine all of them in a single key to ensure that weakness in one of the? Is XOR enough? Using a cryptographic hash function is not acceptable because it may have a backdoor (so instead of multiple sources we get back to trusting only one).