> Figure out some complex method to make a backdoored key which is backdoored in a way that _only they_ can exploit. I don’t disagree with your conclusion, but

> Figure out some complex method to make a backdoored key which is backdoored in a way that _only they_ can exploit. I don’t disagree with your conclusion, but we are pretty sure the NSA has engaged in these attacks before: launching and pushing to standardize a patently bad RNG with very suspicious constructs and then bribing RSA Labs $10m to make it the default in their products. So option three isn’t just good in theory, the NSA very likely put it into practice with Dual_EC_DRBG.