The problem is that the NSA (and USG in general) views security in terms of perpetuating the status quo, rather than letting broken institutions fail so that better approaches can take their place. It's akin to how the guy putting a skimmer on ATMs is at worst a red herring - the banks are the actual culprit by still using info-only cards with plaintext account numbers, 36 years after D-H! In order to actually move forward, at some point ATM impersonation should stop being considered fraud as the banks have had plenty of time to understand that their assumptions are utterly faulty and that they actually know nothing about the identity of an ATM user (and therefore under the current system have no authorization for withdrawals). But instead of secure user-based tokens with explicit capability limits, we get ever more feel good patches on a fundamentally unsolvable problem.