Fix weak keys so we can check the root certificate key length

Only check weak RSA keys in the trust store, don't check trust anchors for expiration date.