Shared PRNG Stream

A non-cryptographic PRNG is used both to generate long-lived secrets (signing keys, bootstrap identifiers, session tokens) and to produce values the server returns to unauthenticated callers. The two uses share generator state. Observing enough of the public outputs reconstructs the state and derives the secrets. The entropy of the secret is bounded by the entropy an attacker cannot observe through the public path; for a process-global PRNG, that bound is zero.