The modulus lengths generate-key serves: the standard sizes,
closed as an enum so a nonstandard or sub-2048 generation request
is unrepresentable. (Import admission is wider — see the family
contract above and the signing interfaces’ window — because
existing keys are facts; new keys are choices.)
The mint-bound digests RSA signature verification serves: RSA’s
parameterization is the digest alone — the modulus length is a
property of the imported material, reported by
verifying-key.algorithm-length. (Each algorithm interface
names its closed set of parameterizations <algorithm>-variant;
the two RSA signature interfaces share this one.)