Consider our needs wrt changed security properties in rand 0.9
Rand 0.9 (not yet released as of this writing) changes some of the policies from previous instances of the rand crate.
See the changelog, with special eye towards these changes:
These changes are not IMO fatal, but we should think about our RNG strategy going forward and see if we want to pull back from using thread_rng() in so many places.