Assert >=2048-bit RSA keys, Ed25519, Ed448, and some improvements to diagnostic reporting

GPG has these additional diagnostics we don't surface.

And we add support for --assert-pubkey-algo with a default allowing only >=rsa2048,ed25519,ed448.