A positive integer is a safe RSA modulus if, after removing all its prime factors less than 512 bits, it is composite and has size at least 2048 bits.
I want to build the smallest-possible safe RSA modulus without a trusted party. (The use case is for an RSA-based verifiable delay function to be used on a blockchain.) The strategy is to randomly sample several random numbers $N_1, ..., N_k$ and multiply them together. Each $N_i$ has some probability $p$ of being a safe RSA modulus so the product $N_1...N_k$ has probability $1 - (1-p)^k$ of being safe.
The above strategy of multiplying randomly chosen integers was pioneered by Thomas Sanders in the context of RSA accumulators. He used a stricter definition of a safe RSA modulus which only looked at having at least two primes above a minimum bit size. The reasoning behind suggesting this less strict definition of a safe RSA modulus is to maximise the probability $p$ so as to minimise the size of the final RSA modulus.
The "512 bits" parameter was chosen (conservatively) to protect against the ECM which has found primes of size up to 273 bits. The "2048 bits" parameter was chosen (conservatively) to protect against the GNSF which factored numbers up to 768 bits.
Is the above definition of a safe RSA modulus actually safe to use in production?