By "scalably factor", I was referring to their ability to take arbitrary 1024 bit public keys as they appeared in random TLS sessions on the Internet and factor them on demand.

NSA can virtually certainly target a specific, hardcoded 1024 bit key and break it. In fact, leaving out the cost and difficulty of recruiting the team to actually put the pieces together, the typical California venture capital firm has the resources to build a machine to do that today. Eran Tromer put the cost of such a machine in the single-digit millions, many years ago.

Apropos nothing: the gap between a 1024 bit key and a 2048 bit key is enormous. The thing that allows the NSA to meaningfully attack a 2048 bit key is likely to take RSA out altogether (and with it probably multiplicative finite field --- ie, "conventional" --- Diffie Hellman).

Yea, this is one reason why I don't consider 1024-bit end entity certs (as opposed to roots) that much of a threat.

Watson Ladd has pointed out that since breaking authentication 10 years after it's been deprecated does not let you retroactively MITM someone but breaking key exchange 10 years after it's been deprecated allows decryption of stored intercepts, KEX should be stronger than certificates. So make sure your TLS server with 1024 bit key uses ECDHE or 2048 bit DHE, not plain RSA KEX.

Yea, it would still be at the customer's own risk.

Well, they have very good mathematicians.

Also, there's the possibility that even if a product uses a 2048 bit RSA key it might have been weakened.

"As of 2010, the largest factored RSA number was 768 bits long"

I read this as "today, 1024 bit factorizations are possible"

Just because some dude says something in the Internet doesn't make it true. Especially that dude, when he talks about US intelligence agencies.