I believe that there are users who do produce keypairs with arbitrary explicit curves: NSA and its equivalents in other countries. Such agencies tend to like to

I believe that there are users who do produce keypairs with arbitrary explicit curves: NSA and its equivalents in other countries. Such agencies tend to like to use secret algorithms and generating your own curve for internal use is somewhat sane way to do that for ECC. In other words I would not be to surprised if NSA found this bug by accident because it caused some of their internal “secret” cryptosystem to not work at all instead of by actively looking for it.