There&#x27;s no reason to use a public key transform to generate random bits other than to leverage the fact that the tranform is trapdoored with a private key. They are otherwise cost-prohibitive.<p>If you can point to a &quot;good&quot; PKRNG that sees any use, that would be an interesting way to rebut my argument.