Raise the minimum RSA modulus size to 1024 bits.

The first publicly known instance of a 512 bit RSA modulus being factored was in 1999.

In 2009, an individual cracked a 512 bit RSA modulus by themself with a single PC.

The "Factoring as a Service" paper, showing that such keys could be broken in a few hours for tens of dollars, came out in 2015.

In 2018, OpenSSL v1.1.1 set its minimum RSA modulus size to 512 bits. This is still the minimum as of OpenSSL v3.3.1.

People still use 512 bit RSA keys without realizing that they're catastrophically weak.

This should be easy to stop.

I propose the following deprecation stages:

1. OpenSSL limits RSA key generation to a minimum of 1024 bits, but still allows such keys to be loaded/used.
2. OpenSSL drops support for verifying signatures for RSA keys smaller than 1024 bits.
3. OpenSSL fully drops support for RSA keys smaller than 1024 bits.

A more conservative approach could temporarily include an option in openssl.conf to temporarily re-enable dangerously weak keys while systems are updated.

The issue names no files, tests, or entry points. Start by reviewing the three proposed deprecation stages and the RSA key-generation, loading, and signature-verification areas they would affect; done requires an agreed implementation plan for the 1024-bit minimum and any compatibility option.