elif keysize < warning_bits:
                        req.md.annotate(entity_elt,
                                        "certificate-warning",
                                        "keysize small",
                                        "%s has keysize of %s bits (less than %s)" % (cert.getSubject(),