And where exactly did the money go?

$600k is a lot of money to implement an existing standard. That's 4-5 annual engineer salaries. I'm wondering exactly how much work was actually undertook for $600k and whether those doing it (/charging for it/taking the money) felt it was unusual size remuneration.

"$600k is a lot of money to implement an existing standard."

Not if such a requirement includes things like FIPS validation, which is entirely possible in this case.

Plus, in some cases, these things are done in liu of donations, etc.

I can think of plenty of cases where well known contractors on open source projects have been paid very well simply as a way of showing support for that project.