We also know that the NSA hardened crypto against attacks that they knew but were not advertised to the public (DES against differential cryptanalysis, and SHA0). I guess the NSA is too big to be homogeneously the good guy or the bad guy.