We did. Look at Veracrypt, up to this day it's gathering entropy from mouse movements and mixes it with other sources. One of the biggest mistakes is using HSMs. And "trusting" hardware black boxes which claim they generate proper RND. Those are not cryptographically safe methods to store and generate key material. The same with "phone encryption" and the 16 chars limit for android password which goes only through an scrypt() is just fucking insane. And no. Phone HSM doesn't count here. One day it may turn out, all smart cards for "signatures" had bad RNGs. But maybe, only maybe, there is a push, for invalid HSMs, to weaken cryptography. Shorter keys, weaker algo, no new AES. I don't like that.