It doesn't need to be encrypted, just signed by the entropy source. The signature should be verifiable without entropy.