   >Remember that they've promised to let a committee of outside experts see
   >the cryptosystem design.

   I hope there are some silicon jocks on the committee who can follow
   the algorithm through to hardware.  While I doubt the NSA would pull
   any monkey business on this point -- they have to expect that the
   chip will be reverse-engineered sooner or later -- it's an obvious
   opportunity to introduce additional holes.

The chip isn't the place to pull the monkey business - you do it in
the key generation, either by having a mathematical backdoor,
or by having the program on the laptop that supposedly generates the
keys also save a copy of S1 and S2 and leak it out somehow,
or by having the program that supposedly puts the official keys
on the chip actually put a *different* key there (VERY hard to detect,
since the escrow agents have to either trust the NSA laptop or
give each other the S* keys, and they still don't know the algorithm.)
Or have the chip-burner at the factory make copies of the keys.
Or whatever.