The curves brainpoolP160r1 to brainpoolP512r1 (plus "t1" twisted variants with a = −3) use primes and coefficients derived from the digits of π and e, so nobody could have chosen them with a hidden property. The price is speed: their primes have no special form. Common OIDs: 1.3.36.3.3.2.8.1.1.7 (brainpoolP256r1), …1.1.11 (P384r1) and …1.1.13 (P512r1).
Protocol support: TLS 1.2 groups 26, 27 and 28 (RFC 7027); TLS 1.3 groups brainpoolP256r1tls13 (31), 32 and 33, with signature schemes such as ecdsa_brainpoolP256r1tls13_sha256 (0x081A) (RFC 8734); OpenPGP keys (RFC 9580). Browsers do not offer them by default, and WebCrypto does not support them. They are common in German eID and smart-card ecosystems, ePassports and smart-meter gateways. NIST SP 800-186 Appendix H.1 allows brainpoolP224r1 to P512r1 "for interoperability reasons".
On one Apple M4 Max core, OpenSSL 3.6.5 signs about 7,800 messages per second with brainpoolP256r1 against about 87,000 with P-256, because only P-256 has a dedicated optimized implementation. No weakness is known; brainpoolP256r1 offers about 128-bit security.