[TBastiani]

It's also much more costly because the attacker cannot rely on the birthday paradox anymore to reduce the cost per bit of entropy.

Also, it depends on how popular the scheme becomes, you never know! :-D