My post specifically pointed out "It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness." -- just that there i

My post specifically pointed out "It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness." -- just that there is nowhere to embed a secret key that only the NSA would know. The only room in it would be for narrow vulnerabilities that others could discover-- just because there aren't that many bits of control. [As an, aside, the NIST curves do not use random primes, E.g. P-256 is 2^256 - 2^224 + 2^192 + 2^96 - 1, which is a solinas prime with a pretty obvious performance driven structure. As is the case for all the other NIST P-whatever curves. Using primes chosen for field performance is pretty common, e.g. curve 25519 uses a crandall prime]