While the NSA never have given reasons for their recommendations, they did at least to some extent contribute to securing standards in the past. One example was

While the NSA never have given reasons for their recommendations, they did at least to some extent contribute to securing standards in the past. One example was DES, that NSA changed the key schedule, at the same time reducing it from 128-bit to 56 bits around 1976. They never said why, but 15 years later, in 1991, the academic crypto community discovered differential cryptanalysis, and found that the changes suggested by NSA was in fact strengthening DES, not weakening it. The attack made possible by differential cryptanalysis require 2^55 steps, which is the same as a brute force attack against a 56-bit key. That indicates that NSA knew differential cryptanalysis already in 1976, but only modified DES to being able to resist it, not telling about the attack. The reduced key length of the new key schedule indicated the actual strength of the cipher, without revealing the attack. NSA recommendations was also one of the reasons that the Rijndael cipher was chosen as AES. So at least in the late 90s they had some positive reputation. As far as I can tell, the tipping point is 2001. After that, the spy part NSA seems to have all the leverage, and to actively propose backdoored standards is not below their dignity.