do we need to define key size?

[Sakurann]

just for the reference FAPI defines

• shall require and use a key of size 2048 bits or larger for RSA algorithms;
• shall require and use a key of size 160 bits or larger for elliptic curve algorithms;

[tlodderstedt]

@danielfett @paulbastian What do you think?

[paulbastian]

I would define a very limited number of crypto suites that shall be used, obviously ES256 but not so much else

[Sakurann]

related to #112

[nemqe]

Does it make sense to reference NIST recommendations (or any other body) when it comes to key sizes, which hash algorithms with which key size and etc for a subset of what is chosen (RSA / ES256 / Ed25519?)?