- mark rsa 1023 as FIPS, reject RSA key sizes less than 1023. - allow applications to rerun the POST arbitrarily (that is after dlopen).