I think that the NSA's game plan would be the other way around. 1) Write a patch the implements a subtle security flaw in GPG. 2) Kidnap Bruce Schneier's dog 3

I think that the NSA's game plan would be the other way around. 1) Write a patch the implements a subtle security flaw in GPG. 2) Kidnap Bruce Schneier's dog 3) Send ransom note to Bruce Schneier with instructions 4) Bruce Schneier announces fake security hole in GPG and submits tainted patch to foundation 5) Foundation rejects tainted patch 5.5) Have Schneier make a big stink about the foundation not fixing the (non-existent) bug or implementing the (tainted) patch 6) Assassinate Schneier to keep him quiet 7) Mainstream declares it ridiculous that the NSA would have killed Schneier 8) Start rumor that the NSA hijacked the foundation and killed Schneier for trying to patch a critical bug. 9) The foundation's report on the security of the original code is now discredited. 10) Previously secure individuals now install the tainted NSA patch to protect themselves from a non-existent bug 11) If anyone points out the flaw in the patch or the non-existence of the original bug, hire sock-puppets to accuse them of being NSA sock-puppets.