We don't. In cryptography we generally trade off information theoretic security for computational security. This means that (more broadly speaking) we don't usu

We don't. In cryptography we generally trade off information theoretic security for computational security. This means that (more broadly speaking) we don't usually know what anyone has broken if there's no public proof. But that also means that, as a research community, we've mostly accepted that that's okay. Likewise as a heuristic we can generally say the same thing about any cryptographic algorithm that hasn't been publicly broken. And that means that evaluating the security of publicly unbroken cryptography by postulating the hypothetical strength of the NSA isn't very useful. We know the following based on an examination of history: 1) Most vulnerabilities which compromise confidentiality or authenticity actually happen in cryptographic implementations or infrastructure code, not algorithm design; 2) RSA has not been publicly broken. Moreover, we have no research providing a way to break RSA given current technology (nor even a path forward); 3) Quantum key distribution is extremely immature technology, which trades off decades of well-studied literature about computational security to pursue information theoretic assurances. Quantum key distribution is an extremely overengineered and brittle solution. That's not to say it isn't technically cool...but it's difficult to reconcile with everything we know about modern cryptography.