We keep having this come up with some of the EC curves like NIST P-256 for example. There's no evidence that it is actually backdoored, but the consensus seems

We keep having this come up with some of the EC curves like NIST P-256 for example. There's no evidence that it is actually backdoored, but the consensus seems to be that the construction is suspicious, unlike the construction for SHA-2. What do we do with it? Not many in a product development team that is interacting with other companies or organizations can meaningfully defend not using a NIST curve because it looks suspicious.