I think NSA would have foreseen the inevitability of FPGA and ASIC miners and chosen a better proof-of-work function than SHA-2.