add key length/sha best practice?

re webapps joint f2f meeting:

should we add a best practice to the Best Practices draft for RSA-SHA1  
key length of 2048 or if 1024 should expire in year because of  
associated risk?

Note on sha-1 and sha-256?

regards, Frederick

Frederick Hirsch
Nokia