Workaround: have the hypervisor expose the 'rdrand' CPU feature to the VM (but this is in the hands of the hypervisor's provider, not the VM user)