2.) you have thought about it, and chosen to hope/trust that the VM provider has implemented a reliable RNG (and that your server image/snapshot accesses it properly, especially restarted snapshots).