fail if provided certificate is smaller than min_rsa_key_size
if PKCS1.sign fails, we've failed way earlier...