Maybe protocols where the attacker has access to a signature over some data, but doesn't get access to the signed data in plaintext? Then the attacker could try to brute-force values of the signed data using the hash that forms the basis of the signature?
If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.
I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.
I'm sure it's gotten a lot tougher out there for this kind of thing since the Comodo and DigiNotar attacks. Looking forward to more mandatory CT mechanisms!
Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic" CA signatures are 2048 bit and far outside the capabilities of an IBM supercomputer, and problem 3, even after breaking that certificate you still have to target individual TLS connections to use it.
On the other hand, you don't need the world's most powerful supercomputer to effectively crack passwords.
It's not unlikely that the simplest explanation here is just "the NSA will do whatever thing secures it the largest budget". That doesn't mean they won't use those budget-enhancing projects in ways that will shock our conscience!