Most SecureRandom implementations throw an NPE when nextBytes(null) is called, but not the one from SunPKCS11 where it's silently ignored. We might want to specify and enforce at the API level that an NPE should be thrown.