I always had a gut reaction against dice rolls.

Reflecting seriously, I have to reluctantly agree it's a solid concept.

But: why that gut negative reaction? Not because the number of bits is not exactly what you think because of some complex mathematical calculation.

Instead, it's two related principles: 1/ complexity is the enemy of correctness. This is a lot of extra manual steps. 2/ I made up a "law" a long time ago: every time a user sees their secret key on a screen it cuts their security in half. This is a gray area: you may be entering the key material in chunks, and also a 'screen' on a hardware wallet is not the same as a computer screen.

I've come round to it over the years, it's a sensible idea, but I'm still slightly suspicious.

We should be focused more on an audit step: however you generate the entropy, is there a way you can check the process is working? Dice rolls don't fit that idea so well (compared with machine-seeded).

I'm reminded of an excellent point Gmax once made abou wallet dev: when you generate addresses for users, you should sanity check that you can actually sign against it, before giving it to the user, so they don't send their money to a black hole.