Even better than curve25519, I would prefer to see the related curve448 supported. I haven't heard any reason to prefer the NIST curves when open alternatives e

Even better than curve25519, I would prefer to see the related curve448 supported. I haven't heard any reason to prefer the NIST curves when open alternatives exist. From what I understand, curve25519 is significantly faster than the NIST curves, in addition to being better understood. And it isn't just DJB speaking against the NIST curves. There's a relevant quote from Bruce Schneier here: https://en.wikipedia.org/wiki/Curve25519#History https://en.wikipedia.org/wiki/Curve25519#History The only real advantage I know of with the NIST curves is that they might be more widely supported, which you mentioned, and which is all the more reason why it would be good for an organization like Let's Encrypt to push the industry forward with regards to curve448 support. I wouldn't mind if they offered options for what kind of certificate you would like them to issue, so people who favor NIST curves could get a certificate signed that way, and people who prefer curve25519 or curve448 could get a certificate signed that way, but I also realize that more maintenance burden is never fun. But, those are just my thoughts on the issue... maybe I'm completely wrong.