They have a hardware RNG but it sure isn't based on a reverse biased diode. They claim to be ring oscillator based, though their operation is not independently verifiable.

Their design-- using AES as a whitening postprocessing step-- would make it extremely easy for them to return something like an aes stream based just on a counter and secret key as a result of an almost undetectable attack.

Good to know, I assumed they'd use the best available:

https://en.wikipedia.org/wiki/Noise_generator

AFAIK you can't just put a reverse bias diode generator in a processor because it requires a different process and relatively high voltages (as ICs go).

In a way, the system does not guarantee there is no kleptographic attack either since the CPU acts like a black-box device

True enough, though the AES DRBG output based HWRNGs would be a great target-- a highly specific nobus or near nobus attack with just a dopant change breaking a single gate... and then the RNG is just some fixed AES stream known to the attacker.