We're researchers in both constructive and destructive aspects of elliptic-curve cryptography. We started issuing warnings about the security dangers of the NIST elliptic curves before it became fashionable to do so. We've proposed alternatives that are faster and stronger, including Curve25519, Ed25519, and Curve3617. Curve25519 is now the go-to alternative curve for people wanting speed and implementation security; it's also not tainted by NIST/NSA. In 2007 we pointed out that Edwards curves are faster and easier to implement securely than standard Weierstrass curves. Edwards curves are also mathematically simpler, allowing a much friendlier introduction to ECC.