diff --git a/crates/sign/src/keys.rs b/crates/sign/src/keys.rs
index e4ab6d5fcc..0521c5d914 100644
--- a/crates/sign/src/keys.rs
+++ b/crates/sign/src/keys.rs
@@ -386,7 +386,7 @@ impl PublicKey {
     /// "RSA 2048-bit", "ECDSA P-256"…
     pub fn describe(&self) -> String {
         match self {
-            PublicKey::Rsa { n, .. } => format!("RSA {}-bit", n.len() * 8),
+            PublicKey::Rsa { n, .. } => format!("RSA {}-bit", rsa_bits(n)),
             PublicKey::P256(_) => "ECDSA P-256".into(),
             PublicKey::P384(_) => "ECDSA P-384".into(),
             PublicKey::P521(_) => "ECDSA P-521".into(),
diff --git a/crates/sign/tests/crypto.rs b/crates/sign/tests/crypto.rs
index 33cb0283a5..a33a136489 100644
--- a/crates/sign/tests/crypto.rs
+++ b/crates/sign/tests/crypto.rs
@@ -560,6 +560,10 @@ fn small_rsa_keys_say_so_and_others_do_not() {
     assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).weakness(), None);
     assert_eq!(rsa(vec![0xFF; 512]).weakness(), None);
     assert_eq!(rsa(Vec::new()).weakness(), note, "an empty modulus is not a strong key");
+    // The key description counts the same bits, so it never says 2048 next to the warning.
+    assert_eq!(rsa([vec![0], vec![0xC0; 128]].concat()).describe(), "RSA 1024-bit");
+    assert_eq!(rsa([vec![0x7F], vec![0xFF; 255]].concat()).describe(), "RSA 2047-bit");
+    assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).describe(), "RSA 2048-bit");
     assert_eq!(PublicKey::P256(vec![4; 65]).weakness(), None);
     let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
     assert_eq!(id.certificate.public_key.weakness(), None, "the 2048-bit test identity");