Increase default DKIM key bits to 2048

This is the current recommendation in RFC 8301 from early 2018.

Fixes: #333

docs/release-notes.rst

@@ -7,9 +7,15 @@ NixOS 25.11
 - The ``systemName`` and ``systemDomain`` options have been introduced to have
   reusable configurations for automated reports (DMARC, TLSRPT). They come with
   reasonable defaults, but it is suggested to check and change them as needed.
+- The default key length for new DKIM RSA keys was increased to 2048 bits as
+  recommended in `RFC 8301 3.2`_.
+  We recommend rotating existing keys, as the RFC advises that signatures from
+  1024 bit keys should not be considered valid any longer.
 - DMARC reports are now sent with the ``noreply-dmarc`` localpart from the
   system domain.
 
+.. _RFC 8301 3.2: https://www.rfc-editor.org/rfc/rfc8301#section-3.2
+
 NixOS 25.05
 -----------