That probably works. I would think it would be easier to verify a single source and then use it.

Yes, you have to trust (or verify) the concatenation function - which should be simple to verify. Simplicity is the friend of security here. Complexity and obscurity is an engineering mind theatre - bigger surface = more threat vectors. -- It's like trying to have the smartest central bankers to ...