It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA).
DSA is a sort of hybrid of the ElGamal and Schnorr signature schemes.
My question is this. Based on what we know now, why did NSA invent a new scheme rather than just adopt ElGamal or Schnorr? I am looking for informed speculation based on what is known today about the relative strengths and weaknesses of these schemes, with references. (References for the strengths and weaknesses, I mean, not for the speculation.)
If your speculation is that NSA did something to weaken DSA, what could they possibly have gained other than the ability to forge signatures?
Or was DSA just the result of IP concerns? If so, I would like to see a reference for that, too.