if keysize < error_bits:
                        req.md.annotate(entity_elt,
                                        "certificate-error",
                                        "keysize too small",
                                        "%s has keysize of %s bits (less than %s)" % (cert.getSubject(),