Makes sense. I just posted an article with some ideas - brainstorming with Kimi - on the topic. Seems like there are standards we should be pushing for like tracing the execution path through binaries and even showing / attesting to the entropy sources executed during seed generation. All mechanisms that should be thoroughly tested in the codebase.
Obviously this only works for vendors with the code available, but it seems like it would be a significant improvement in traceability and increase the ability of end-users to validate the security claims.
