“Second, and most importantly, verifying the validity of parameters is even harder than generating them. For example, picking a random prime is way easier than adversarially checking if a given number is prime. This adds a tremendous amount of complexity to the security-critical, attacker-reachable hot path.”
Custom curves per user sound like spreading the risk. In practice they hand the attacker a dial. Every parameter the other side can choose has to be validated at runtime, and every validation check is a place for a bug. Logjam, the last time custom parameters helped, really proved 1024-bit Diffie-Hellman was too weak to use. If your scheme only survives because not every key falls at once, it is already broken.