Too Late for the NIST P-Curves
The NSA conspiracy theory about the NIST P-curves (P-256 and friends) has aged into irrelevance:
If quantum computers are nigh, then we still don't use NIST P-curves, because they're classical cryptography vulnerable to quantum computing.
But to address the conspiracy directly, the seeds were found. It doesn't really look like a backdoor. I was probably wrong.
The chain of custody was broken, the numbers were magic because of it, and I had a right to be suspicious. (People had a right to tell me not to be, but like, Curve25519 was right there with all known problems eliminated by design.) It's been a long, intensive ride, and now there's no payoff because of quantum.