Firstly, NSA recommended specific NIST-brand ECC that didn't have many of the practical security advantages of what's being recommended here. Secondly, if you

Firstly, NSA recommended specific NIST-brand ECC that didn't have many of the practical security advantages of what's being recommended here. Secondly, if you were really that worried about quantum computing, you'd use a quantum-hard kex, like Google did with CECPQ1. (I can't speak to why the NSA doesn't tell you to do that. I'm sure it has people in it that think so.)