> A NOBUS backdoor in an asymmetric primitive that looks like "X% of all keys is weak"

That’s not a NOBUS backdoor. It’s a different type of backdoor and I’m pointing out that proving there is no NOBUS backdoor doesn’t mean there’s no other backdoor.

It’s a counterexample that I came up with in 5 minutes, not a proof that it’s useful to a state actor.

Why would they use a backdoor that isn't NOBUS?

And why would they still be migrating top secret communications towards the algorithm they (NOBUS or not) have a backdoor in?

That doesn't sound very COMINT to me.