• OpenPGP.js version: 5.6.0
• Both Browser or Node.js

In this setup PK RSA1024 [certifyKeys, signData], SK RSA4096 [encryptCommunication], we would expect the key to be unusable for both signing and encryption because the encryption subkey can't be securely verified with the weak primary key.
However, the library allows to encrypt with this key regardless of minRSABits setting value.
FlowCrypt/flowcrypt-browser#4905 (comment)