Backdoor in NIST elliptic curves Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose $\psi$ be a map that
$$\psi:E \to Z_n$$

Also, let $a,b\in Z_n$ such that $\psi(P)=a,\psi(Q)=b$. Then we have:


  $$k=ba^{-1}$$


All recommended NIST elliptic curves(P-192,...,P-521,K-163,...) have prime orders.

Also When $\#E(F_p)=p$ we have polynomial time for computing such map. This is well known attack that is called anomalous curve attack.

What is the reason for confidence to them? Are computations speed enough?
Yes, the attack you sketched out would work - in theory.

In practice, it's an efficient (computable in polynomial time) mapping $\psi:E\rightarrow\mathbb Z_n$ we're lacking. As for the unefficient mappings, $\psi:x\cdot P\mapsto x$ would be perfectly fine theoretically, but we don't know how to calculate it (it's the elliptic curve discrete logarithm problem, aka ECDLP).

Furthermore you might say: "well, we can construct an isomorphism in theory, so why don't we just map it somehow and apply the GNFS on $\mathbb Z_n$?" The problem is again, that we don't know an efficient mapping and even if we would, we would need one (for this attack) that preserves birational equivalence to transfer addition laws from one group to the other and if such a mapping would exist, people probably would have found it in ECC's 25 year(+) history.

Bottom line: The DLP isn't hard because of the elements you want to find, it is hard because of the element's representation.