He found problems with the identity binding where if even a short-term key was compromised, it would allow impersonation attacks in the future[1]. That's a poor way to handle failure (and it's fixed in CurveZMQ with the minor changes he proposed) but it requires a key compromise to exploit so it's not as bad as a straight-up misbinding attack which any MitM can exploit.

[1] https://codesinchaos.wordpress.com/2012/09/09/curvecp-1/