Avoiding the backdoor does not require changing the points (and possibly getting in patent trouble). Even with malicious points, truncating enough bits out of e

Avoiding the backdoor does not require changing the points (and possibly getting in patent trouble). Even with malicious points, truncating enough bits out of each x coordinate is enough to thwart the attack. I don't know why this is not pointed out more often. I'm honestly far more surprised by finding out that another factorization-based (Micali-Schnorr) DRBG standard comes with 'default' public keys.