How is NSA breaking so much crypto? (2015)
Wouldn't it be easiest to just backdoor all  clients, everywhere? And ideally you'd even do some basic threat analysis at the device to save you some compute resources.