While I get your point, is there someone better to trust? Not every cryptographer works for the NSA, and I can't think of a way for a protocol to be looked at by as many cryptographers for flaws as the one chosen by NIST to be a standard. Maybe the runner-up that WASN'T chosen by NIST is possibly NOT the one the NSA knows about a flaw in?