fix(sign): the key description counts the modulus bits like the warning

describe() named an RSA key by its modulus length in bytes times
eight, so a 2047-bit key read "RSA 2048-bit" next to the new warning
that it is shorter than 2048 bits, and a modulus with a leading zero
byte read 8 bits too long. It now uses rsa_bits, as weakness() does.

crates/sign/src/keys.rs

@@ -386,7 +386,7 @@ impl PublicKey {
     /// "RSA 2048-bit", "ECDSA P-256"…
     pub fn describe(&self) -> String {
         match self {
-            PublicKey::Rsa { n, .. } => format!("RSA {}-bit", n.len() * 8),
+            PublicKey::Rsa { n, .. } => format!("RSA {}-bit", rsa_bits(n)),
             PublicKey::P256(_) => "ECDSA P-256".into(),
             PublicKey::P384(_) => "ECDSA P-384".into(),
             PublicKey::P521(_) => "ECDSA P-521".into(),

crates/sign/tests/crypto.rs

@@ -560,6 +560,10 @@ fn small_rsa_keys_say_so_and_others_do_not() {
     assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).weakness(), None);
     assert_eq!(rsa(vec![0xFF; 512]).weakness(), None);
     assert_eq!(rsa(Vec::new()).weakness(), note, "an empty modulus is not a strong key");
+    // The key description counts the same bits, so it never says 2048 next to the warning.
+    assert_eq!(rsa([vec![0], vec![0xC0; 128]].concat()).describe(), "RSA 1024-bit");
+    assert_eq!(rsa([vec![0x7F], vec![0xFF; 255]].concat()).describe(), "RSA 2047-bit");
+    assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).describe(), "RSA 2048-bit");
     assert_eq!(PublicKey::P256(vec![4; 65]).weakness(), None);
     let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
     assert_eq!(id.certificate.public_key.weakness(), None, "the 2048-bit test identity");