Only allow PSS signatures with RSA keys and TLS 1.3