I don't quite believe that the NSA can reliably perform a ciphertext-only attack on RSA or even AES. As far as we know, integer factorization is still hard, so

I don't quite believe that the NSA can reliably perform a ciphertext-only attack on RSA or even AES. As far as we know, integer factorization is still hard, so RSA is still secure, given large enough keys. There's Shors Algorithm for quantum computers but these are still very much experimental things and subject to research. Besides, building, maintaining and running one is incredibly expensive. I might underestimate the NSA here though. AES has been broken in theory but the results have no real repercussions. A "break" is anything faster than brute-force, no matter whether it actually makes the process computationally feasible or not. In the real world it doesn't currently matter whether we search through 2^256 keys or have a complexity of 2^254.4. Both are vastly out of the reach of current computers. AES has been rated as "suitable for top secret". There is reasons to believe that the NSA uses AES themselves. Knowing about a ciphertext-only attack would put their very own secrets at risk. If such an attack exists, it will only be a matter of time until somebody else finds it. There are other weaknesses in both these systems though, most of which are due to implementation and physical realities. Side-channel attacks are known for both RSA and AES as well as for SSL. So yes, they might very well collect everything right now but unless they are many decades ahead of the rest of the world in terms of cryptanalysis, they can't do anything with the data for now.