Ironically, by using a modern, stripped down signing system like this, they've probably increased their opportunities to do interesting things down the road, since they don't have all the possible weird interactions with the PGP system to consider.

Still have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.

You can tell how long a key is just by looking at it. You can then say anything you want. The use of particular keys is a Debian policy issue. It has nothing to do with the use of a particular message format like OpenPGP.

That's not how it works, no. This is a gpg specific issue as it does not communicate the key size over the status fd.

We don't parse the keys ourselves for obvious reasons.

Dunno about that but --with-colons certainly works to show the key length of a key.

i am pretty sure you can mark them yourself. but that they are generally still used, well that's called backwards compatibility. and that's needed.