I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein).
Now some already have noticed that he has an opinion towards cryptographic questions.
In his 2008 paper ("RSA signatures and Rabin–Williams signatures: the state of the art" by Bernstein) on state-of-the-art signature schemes he documents the "evolution" of RSA and I get the impression he's advertising the usage of the rabin-williams (RW) cryptosystem with the optimizations mentioned in the paper.
Now (finally) my question:
As Rabin-Williams seems to have so many advantages over RSA (smaller keys, smaller signatures, faster verification, ...) why isn't it in widespread use and everyone still uses "old" RSA?
This seems a bit odd as the latest optimizations are dated as of 2003 (!) which is ten years ago and I think there's also the proof that square-root is equally hard as factoring and I think RW even reduces to FACTORING.