For $d$ a non-zero integer, let $E_d$ be the elliptic curve
$$
E_d \colon y^2 = x^3+dx.
$$
When we let $d$ be $p = 2^{2^k}+1$, for $k \in \{1,2,3,4\}$, sage tells us that, conditionally on BSD,
$$
\# Ш(E_p) = 2^{2k-2}.
$$
Together with the fact that $\operatorname{Sel}^{(2)}(E_p) \cong (\mathbb{Z}/2\mathbb{Z})^2$ (this can be found in Chapter X of Silverman's book) the above implies, still assuming BSD, 
$$
Ш(E_p) \cong (\mathbb{Z}/2^{k-1}\mathbb{Z})^2.
$$

<blockquote>
<h2>Question</h2>
<p>Restating the above in a more explicit format, assuming BSD we have:
\begin{align}
Ш(E_5) & = 0 \\\
Ш(E_{17}) & \cong (\mathbb{Z}/2\mathbb{Z})^2 \\\
Ш(E_{257}) & \cong (\mathbb{Z}/4\mathbb{Z})^2 \\\
Ш(E_{65537}) & \cong (\mathbb{Z}/8\mathbb{Z})^2 
\end{align}
Is there any "reason" why this should be true? I realize that this is a "soft" question, but the above pattern seems so remarkable that I feel compelled to look for an explanation at some level.</p>
<p>An alternative question would run as follows: if $p=2^{2^k}+1$ is prime, do we always have 
$$
Ш(E_p)\cong(\mathbb{Z}/2^{k-1}\mathbb{Z})^2?
$$</p>
</blockquote>
**How this came up:** I was using sage to search for elliptic curves $E_d$ of the form
$$
E_d \colon y^2 = x^3 + dx
$$
with the additional property that
$$
Ш(E_d)[2] = 0,
$$
the underlying motivation being simply that for the course I am teaching I wanted to compile a list of elliptic curves on which a partial $2$-descent is possible without extending the ground field, and gives a sharp bound on the rank.