D.J. Bernstein stated that he wasn't aware of any patents that applied to Curve25519[1]. This leads to the following statement in the GnuPG v2.1 FAQ[2]:
>For many people the NIST and also the Brainpool curves have an doubtful origin and thus the plan for GnuPG is to use Bernstein’s Curve 25519 as default.
A very large portion patents related to ECC are optimizations for characteristic 2 curve (interesting in smart cards, perhaps, but not used here), and/or are roughly around now.
The non-ed25519 ECC techniques in the OpenPGP standard have well establish too-old-to-be-patentable prior art: https://tools.ietf.org/html/rfc6090
The Schnorr signature patent that expired in 2008? The one-bit-sign point compression patent that expired earlier this year? The algorithms in RFC6090 which would be too old for patents anyway?
While there were (and are) some specific implementation techniques for efficient ECC covered by patents, many of them have now expired, and many others have better patent-free alternatives anyway.
