The pipefail option causes the script to terminate with an error,
because the pipes are closed while they are still being written
to from /dev/urandom.
It would be possible to disable pipefail locally for this command,
but using openssl seems easier and more robust anyways.