RSA: Decide what to do if byte-length of d is shorter than BITS/8.

[keks]

Currently we just return an error, but this has led to us rejecting keys generated by OpenSSL (in the benchmarks, not the real world). What is the right thing to do here? Accept N-1? N-2? Anything?

More context:

That's indeed weird. Would you need to pad it to use it with hacl maybe? But since we don't care too much about RSA right now, let's put it on the pile of things to investigate when we need it.

Originally posted by @franziskuskiefer in #840 (comment)