I read this twice trying to figure out why it matters if we trust NVD. It's a number assigned to vulnerability reports; that's it. Who cares?
I just had one where we were asked to remove a management client for an internal server that had a DOS vulnerability reported (which could not be triggered by the management client). I pointed out that removing the client does not mitigate the DOS issue - and we would be effectively causing a denial of service on ourselves! No dice. Scan shows vulnerable version, must make number of reported vulns go down. Zero thought, huge effort.
It does huge damage to security and the business to take this kind of approach, but it's depressingly common.
Mostly I think it boils down to a combination of a CYA mentality, risk averse managers and unskilled security personnel.
Making a decision that this Critical (potential) vulnerability does not need fixing is a decision that none of the above want to make and stand by, or have to explain.
Then, you get a report, say, that calling X with malicious data causes reboot. DoS! But software vendor looks at it and sees that in order to call X you need so much permissions, you can do reboot directly. What now?
Also, not every report submitted to be published as CVE goes immedeately public. Where does it go? If there is CVE about RCE in popular software, who knew about it before it went public?
We've had no real updates to the existing CVEs for over a year now - lots of them just pending assessment. The communication about it has been misleading or non existent. Then the recent funding issue which threatened to close it down entirely, followed by maybe 11 more months of it? Who knows.
A huge number of infosec processes and tools depend on CVEs and the NVD as the main source of them.
So the trust is gone or rapidly going. We are all looking around in the infosec community and wondering what comes next.