Would RSA make sense if we used no computers? I was recently wondering - would RSA be useful if we brought it to, say, medieval times? Could you choose the keys so that you could encrypt/decrypt messages quite easily, but factoring the private key would, say, take over 1000 days for 1000 people, provided that they used paper and pencil only and wouldn't make any mistakes?
I thought about this and have done a bit of research, and the answer is no.
The problem is the gap between the difficulty of factorisation versus prime generation isn't really large enough at the scale of primes/moduli we can work with.
By 1588 the largest prime discovered was 524287, thanks to Pietro Cataldi. This was a prime generated by a single person's work. I don't know how much effort this took, but given that it was a world record at the time, I think we can assume it was a fair amount of effort.
In order to have a secure instance of RSA, we'd probably want to generate a modulus using two six-digit primes. That's already quite a bit of work.
However, a nation-state can draw on more resources. They could hire a team of people to try and break the message. One observation is that there aren't actually that many primes below 1,000,000: there are only 78,498! If we consider only the primes between 100,000 and 1,000,000, this number comes down to 68,906.
A nation-state could use the sieve of Eratosthenes to find all the primes below 1,000,000. This would be a one-off effort.  They would then need to attack any modulus which is the product of two six-digit primes.
Finally, to factor a particular spy's modulus they simply could give it to a pool of people who would work down through the list.
Let's say one person can try one division every five minutes. That seems like quite a long time given the size of the numbers. Nonetheless, in one eight-hour working day, they could try 96 divisions per day. Across a pool of 20 people it would take 35 days to run through the entire list.
In practice, most moduli would be solved much sooner than this because both primes will appear somewhere in the list.
This attack is entirely practical and thus makes RSA pretty useless for encryption in that historical period.