Currently the activation challenge lets a caller supply a source of randomness other than crypto/rand, but it's not used in some places. Plumb the source through the call chain.