One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports any kind of DSA. In contrast to that, RSA, while usually being used for encryption, can also be used for digital signatures and behaves deterministic, i.e. signing the same message again will yield the same signature everytime. Lacking the requirement of a RNG (other than in key generation) this is why RSA is available on many smartcards, which would make bitcoin much safer without requiring a rather complicated offline-wallet setup.
So, does ECDSA provide anything bitcoin absolutely needs that RSA cannot achieve? Or is it merely bad luck in Satoshi's choice?
k
for signatures deterministically instead of by RNG. See RFC 6979.