bip85: Say when applications must use BIP85-DRNG #2333

There has been confusion during bip85 app proposals which entropy source to use, lets make their choice explicit in the standard.

What: An application that could need more than the 64 bytes of HMAC-SHA512 output for any of its derivation paths MUST use BIP85-DRNG for all of its derivation paths. All other applications MUST use the HMAC-SHA512 output directly.

How: Two sentences after the paragraph that introduces the HMAC output, a one-line rationale footnote, the version bump and a changelog entry.

Why: This is the per-application rule akarve proposed on #2295 (Sep 19 and Oct 12, 2026). Every existing application already follows it: RSA and DICE use BIP85-DRNG, and BIP39, HD-Seed WIF, XPRV, HEX, PWD BASE64, PWD BASE85 and Nostr never read more than the 64 bytes. No output changes. A new MUST is a backward-compatible change to the specification, so this is a MINOR bump to 2.2.0 per BIP 3.

@akarve this tiny PR implements your entropy source selection suggestions. Ready for review at https://github.com/bitcoin/bips/pull/2333/commits/0f2abb380b6f5b810d467ae69584fee6f6e7b74d

Concept ACK. An independent implementation, btclib-wallet's bip85.py, already follows the rule: only DICE and RSA read BIP85-DRNG, and every other application uses the HMAC output directly, so no output changes. Its 65 BIP85 tests, which include every vector the BIP publishes, pass. The RSA section still says the key generator "should" use BIP85-DRNG; a "MUST" there would match the new rule.

@fametrano 4dbd8c38a410633c806df4a235bfc10821d55ddb changes "should" to "MUST" use BIP85-DRNG in the RSA section as you requested.

ACK 4dbd8c38a410633c806df4a235bfc10821d55ddb. The RSA section now says MUST, as the new rule at line 62 requires. The test vectors are unchanged, so the btclib-wallet check in my Concept ACK still holds.