Few comments:

1) StartSSL doesn't generate it in the browser (on a secure piece of hardware IIRC), which depending on your viewpoint is good/bad.

2) No CA will allow you to get a 1024 bit cert (you're correct)

3) You should be sending the GeoTrust Global CA cert because it isn't trusted everywhere, and if it's not sent you'll get errors before you get SNI/SHA1/SSL3 errors...

4) The "(unknown)" will always occur on FireFox, unless you have an EV certificate (even OV does not show this)