Three reasons: - Technical: if the security of the signature of a document becomes questionable, there is often the option to stop considering the key valid, and make a new signature with a larger key size, restoring security; when for encryption (one of the common goal of key establishment), we can't make the ciphertext disappear from the adversary's archive. Therefore, at any given time, we arguably need less security margin for signature than for key establishment targeting long-term confidentialy. - Scope: my reading of NIST's FIPS 186 standard is that it specifies modulus sizes mostly for interoperability purposes, with security level not the main scope; when NIST SP 800-56B is a recommendation with security level in scope. At least, only the later includes comparison with symmetric cryptography key sizes. - Historical: [FIPS 186-4][1] (July 2013) is a standard with a long history, with RSA included in FIPS 186-1 (December 1998) which essentially approved ANS X9.31, with minimal key size set to 1024-bit for both, which then made a lot of sense. When [NIST SP 800-56Br1][2] is more recent (September 2014), revising earlier [NIST SP 800-56B][3] (August 2009) which still allowed 1024-bit RSA. [1]: https://doi.org/10.6028/NIST.FIPS.186-4 [2]: https://doi.org/10.6028/NIST.SP.800-56Br1 [3]: https://doi.org/10.6028/NIST.SP.800-56B