I really dont understand the article nor your explanation. What does it matter if the plaintext isnt random? The csrng will hide any un-randomness.

> However, this is all predicated on the key being drawn from a uniform distribution

So, we're talking about the generation of the key? Are you trying to say that /dev/random isnt secure (i.e. the source when using algos like SSL)?