rsa: make a separate exn, expand docs
unify handling of pkcs1 op pairs