&gt;Kernel CSPRNGs do need continually updated entropy pools. But not because their original entropy is depleted! Rather: you want your RNG to be updated so that its &quot;key&quot; changes regularly, so that if your system is compromised transiently, you&#x27;ll recover.<p>It&#x27;s very unlikely that a compromise will be temporary. This situation &quot;transient compromise&quot; will never happen. Moreover, once a system is compromised, by definition you cannot trust it until replacing it from a known-good source or backup, at which point, you just start the CSRNG with new entropy.<p>No system should need or even attempt to recover from a transient compromise, you are just causing a false feeling of security.