Changes:

• add config.rejectPublicKeyAlgorithms to disallow using the given algos to verify, sign or encrypt new messages or third-party certifications
• consider config.minRsaBits when signing, verifying and encrypting messages and third-party certifications, not just on key generation
• when verifying a message, if the verification key is not found (i.e. not provided or too weak), the corresponding signature will have signature.valid=false (used to be signature.valid=null). signature.error will detail whether the key is missing/too weak/other.

Generating and verifying key certification signatures is still permitted in all cases.