code: func (policy *KeyPolicy) goodKeyRSA(key rsa.PublicKey) (err error) {
  	if !policy.AllowRSA {
  		return fmt.Errorf("RSA keys are not allowed")
  	}
  
  	// Baseline Requirements Appendix A
  	// Modulus must be >= 2048 bits
  	// Removed max keySize from original package version
  	modulus := key.N
  	modulusBitLen := modulus.BitLen()
  	if modulusBitLen < 2048 {
  		return fmt.Errorf(fmt.Sprintf("Key too small: %d", modulusBitLen))
  	}
  	// Bit lengths that are not a multiple of 8 may cause problems on some
  	// client implementations.
  	if modulusBitLen%8 != 0 {
  		return fmt.Errorf(fmt.Sprintf("Key length wasn't a multiple of 8: %d", modulusBitLen))
  	}
  	// The CA SHALL confirm that the value of the public exponent is an
  	// odd number equal to 3 or more. Additionally, the public exponent
  	// SHOULD be in the range between 2^16 + 1 and 2^256-1.
  	// NOTE: rsa.PublicKey cannot represent an exponent part greater than
  	// 2^32 - 1 or 2^64 - 1, because it stores E as an integer. So we
  	// don't need to check the upper bound.
  	if (key.E%2) == 0 || key.E < ((1<<16)+1) {
  		return fmt.Errorf(fmt.Sprintf("Key exponent should be odd and >2^16: %d", key.E))
  	}
  	// The modulus SHOULD also have the following characteristics: an odd
  	// number, not the power of a prime, and have no factors smaller than 752.
  	// TODO: We don't yet check for "power of a prime."
  	if checkSmallPrimes(modulus) {
  		return fmt.Errorf("Key divisible by small prime")
  	}
  
  	return nil
  }
docs: // GoodKeyRSA determines if a RSA pubkey meets our requirements