"They’d switch to a 4096 bit RSA key, but not only was I no longer able to mint my own API tokens, the legitimate ones I’d initially generated still worked." I

"They’d switch to a 4096 bit RSA key, but not only was I no longer able to mint my own API tokens, the legitimate ones I’d initially generated still worked." I wonder how the old JWTs signed with the 512-bit key still work safely, isn't that 512-bit key cracked??