
My speculation does not include or depend upon a trapdoor in RSAREF. I
do not believe that RSA would consent to such.  

However, there are other limitation in the concept of RSAREF in which
NSA has an interest.  It has an interest in a limited number of
implementations, i.e., targets.  It has an interest in fixed key or
maximum modulus size.  

It has a legitimate (literally) right to pursue such interests.  Within
bounds, it probably has a right to pursue those interests by covert
means.  At least it has the same right as the rest of us not to disclose
all of its motives and intentions.  (Institutions are not self-aware;
they do not know their intentions in any meaningful sense.)