A second look is always worthwhile with interesting reading :) Thanks for your excellent blog. Personally, I'll add the *Rewinding random number stream* to your list ; this 2-Factor authentication (2FA) explanation setup was absolutely revealing, especially for a feature now so common as to be required by law in some countries, for instance, in the EU retail banking sector (PSD2).

https://blogs.sas.com/content/iml/2020/08/26/rewind-random-number-stream.html