[backend] switch to RSA@2048 for new signing keys. WARNING: sign must be at least 2.1.5.1 for this to work