I don't think there's a problem with djb monoculture, and I geerally agree that the real enemy is "yet another !@#$%! CBC padding oracle attack". It's not like these things haven't been analyzed by third parties.