Let me clarify a bit then: My criticisms of RSA stem from studying how people implement it in cryptography libraries. More people implement PKCS1v1.5 padding t

Let me clarify a bit then: My criticisms of RSA stem from studying how people implement it in cryptography libraries. More people implement PKCS1v1.5 padding than implement RSAES-OAEP in their application-layer crypto, and that's a problem. Conversely, most of the applications I've analyzed that wanted ECDSA/ECDH used OpenSSL or libsodium. Guess which ones were broken with chosen-ciphertext attacks. If you want a theoretical concern: Index calculus attacks. If you want a practical concern: Look at the traps that cause implementations to be comically insecure.