The in-depth security means you design your system so that it doesn't fall apart if only one of the pieces fall.

As for your comment on the PRNG, it's actually not a very good design. You would rather use a cipher in stream mode which is indeed fed from a hash, because the cipher will have a better and more predictable behaviour over time.

I however don't understand why people were repeating bcrypt as a mantra on your git pull.