My impression is that RSA was covered by patent (from 1983 until 2001). DSA was attractive in part because, while patented, the primary patent was held by the U

My impression is that RSA was covered by patent (from 1983 until 2001). DSA was attractive in part because, while patented, the primary patent was held by the US government and royalty-free. I have vague memories (from circa 1995 comp sci undergrad coursework) that discrete log and integer factorization both appeared similarly difficult as mathematical/algorithmic problems. Thus, if you had to choose between a patent-encumbered protocol and a royalty-free one, it would make sense to choose DSA. That said, it seems to have never offered a particular advantage, and the modern view appears to be that DSA is weaker in practical terms.