While I agree that elliptic curve cryptography is the near-future (not necessarily because of new attacks, but mostly cost-effectiveness), I have trouble seeing how you'd explain the possible pitfalls and attacks to laypeople, without taking an unreasonable amount of pages.
It's one thing to explain the Weierstrass equation, the chord and tangent rule, and how group structure comes from that. But the details get really hairy really quick: anomalous curves, MOV/FR attacks, Weil descent, etc. I'm not saying it's impossible, but it's certainly very very hard to reasonably pull this off.
Another note about elliptic curves is that the safest choices are often not doable by developers because of external pressures. For example, ideally you'd want to use a curve (like Curve25519) that has complete addition formulas, so that you could avoid checks for explicit doubling or points-at-infinity, like you do with Weierstrass curves. Montgomery and Edwards curves allow this, but you can't use them if you need to support standard NIST curves, since they are not reasonably convertible to Edwards form (you can do it, actually, but the arithmetic is now in F_{p^3} instead of F_p).
It's one thing to explain the Weierstrass equation, the chord and tangent rule, and how group structure comes from that. But the details get really hairy really quick: anomalous curves, MOV/FR attacks, Weil descent, etc. I'm not saying it's impossible, but it's certainly very very hard to reasonably pull this off.
Another note about elliptic curves is that the safest choices are often not doable by developers because of external pressures. For example, ideally you'd want to use a curve (like Curve25519) that has complete addition formulas, so that you could avoid checks for explicit doubling or points-at-infinity, like you do with Weierstrass curves. Montgomery and Edwards curves allow this, but you can't use them if you need to support standard NIST curves, since they are not reasonably convertible to Edwards form (you can do it, actually, but the arithmetic is now in F_{p^3} instead of F_p).