The entire script needs to be clearer upon a bit more reflection
Code like:
return xor.to_bytes((xor.bit_length() + 7) // 8, byteorder='big')
is not clear at all just in general and absolutely terrible for a device that is built for cryptographic security. I will update.
Cheers!
Mitchell.