Fix weak keys so we can check the root certificate key length

Only check weak RSA keys in the trust store, don't check trust anchors for expiration date.

https://wiki.mozilla.org/CA:MD5and1024 says that certificates that have public keys that are only 1024 bits or smaller are insecure, and should not be used even in root certificates:

"The date for disabling/removing 1024-bit root certificates will be dependent on the state of the art in public key cryptography, but under no circumstances should any party expect continued support for this modulus size past December 31, 2013. As mentioned above, this date could get moved up substantially if new attacks are discovered. We recommend all parties involved in secure transactions on the web move away from 1024-bit moduli as soon as possible."

It's unlikely that the default cacerts truststore contains these keys, but it's not impossible that someone could have added them manually into the keystore.