tl;dr: The current verification API does not check to see if the leaf certificate's SPKI is something reasonable, and will happily verify an end-entity certificate with a weak key size.
More detail:
The current API uses a "SignaturePolicy" delegate during path building to ensure that chains in the path do not contain weak signatures. This abstraction combines some validations on the SPKI (such as minimum modulus size for RSA keys), as well as policy on signature algorithms (particularly digest used).
The weakness with this abstraction is it does not apply to the leaf certificate, since chain building is not actually verifying signatures signed by this certificate (the caller presumably will though).
We may return a chain that has strong signatures for each certificate, HOWEVER the leaf certificate has a 512 bit RSA key (since there was no signature verified yet using this key, the SignaturePolicy was not called).
This is dangerous, and should instead be done internally to prevent misuse.
Comment 1 by eroman@chromium.org
, Sep 21 2016