add RSA key generation restrictions to primitive layer

We enforce this stuff in each backend (and each backend has different limits).