device id is bad, this info is findable by a motivated attacker, especially if the device id has a pattern (i think in cc case it was 16bit id, but could possibly be reduced to lower entropy contribution based on pattern, or even zero of the attacker knew the ids)

timestamp is bad, because the possible values are a tiny set, and they are highly predictable

keypresses are ok, but they were not part of the standard setup, only if you rolled dice

good one was supposed to be seeded with environmental noise captured by the secure element, allegedly