src/ecc/key_utils.js
function random32ByteBuffer({cpuEntropyBits = 0, safe = true} = {}) {
    assert.equal(typeof cpuEntropyBits, "number", "cpuEntropyBits");
    assert.equal(typeof safe, "boolean", "boolean");

    if(safe) {
        assert(entropyCount >= 128, "Call initialize() to add entropy (current: " + entropyCount + ")");
    }

    // if(entropyCount > 0) {
    //     console.log(`Additional private key entropy: ${entropyCount} events`)
    // }

    const hash_array = [];
    hash_array.push(randomBytes(32));
    hash_array.push(Buffer.from(cpuEntropy(cpuEntropyBits)));
    hash_array.push(externalEntropyArray);
    hash_array.push(browserEntropy());
    return hash.sha256(Buffer.concat(hash_array));
}
function random32ByteBuffer({cpuEntropyBits = 0, safe = true} = {}) {
    assert.equal(typeof cpuEntropyBits, "number", "cpuEntropyBits");
    assert.equal(typeof safe, "boolean", "boolean");

    if(safe) {
        assert(entropyCount >= 128, "Call initialize() to add entropy (current: " + entropyCount + ")");
    }

    // if(entropyCount > 0) {
    //     console.log(`Additional private key entropy: ${entropyCount} events`)
    // }

    const hash_array = [];
    hash_array.push(randomBytes(32));
    hash_array.push(Buffer.from(cpuEntropy(cpuEntropyBits)));
    hash_array.push(externalEntropyArray);
    hash_array.push(browserEntropy());
    return hash.sha256(Buffer.concat(hash_array));
}
Additional forms of entropy are used.  A week random number generator can run out of entropy.  This should ensure even the worst random number implementation will be reasonably safe.

@arg {number} [cpuEntropyBits = 0] generate entropy on the fly.  This is
not required, entropy can be added in advanced via addEntropy or initialize().

@arg {boolean} [safe = true] false for testing, otherwise this will be
true to ensure initialize() was called.

@return a random buffer obtained from the secure random number generator.  Additional entropy is used.