Perhaps the rule that catches RSA, but not One-Click, is something like:

"An invention that applies old theory to solve an old problem in a new way."

The idea being that if the problem is long-known, and the theoretical underpinnings of the invention are long-known, yet the invention itself had not been previously described, then it must be novel and non-obvious.

In the One-Click case, the problem itself was new, so only the efflux of time could show if any solutions based on known theory were obvious or not.