While I get your point, is there someone better to trust? Not every cryptographer works for the NSA, and I can't think of a way for a protocol to be looked at by as many cryptographers for flaws as the one chosen by NIST to be a standard. Maybe the runner-up that WASN'T chosen by NIST is possibly NOT the one the NSA knows about a flaw in?

You're getting downvoted, but it's a good question.

There was a recent paper linked on HN that goes into a lot of the nuance around this question. It's very good (IMO, as an interested outsider):

https://news.ycombinator.com/item?id=31856029

Trust, but verify.

Are you really able to verify at this level of mathematics?

It was meant as a sort of joke; perhaps I should have added some kind of smiley.

Of course I can't do the verification myself. But there are people (stand up, DJB) who can, and I can pay attention to their observations. So perhaps "Trust, but verify by proxy". But that wouldn't have been recognisable as the well-known cold-war slogan...

people who have to buy SRMs