Checking the key size of the cipher is probably dumb, but if we do, allowing it to be less than 128 bits is even dumber.