Change a key's allowed actions in GPG? When you `--gen-key` in GPG, you can choose which actions of Sign, Certify, Encrypt, and Authenticate the key will be usable for. Can these be later _modified_ (i.e. obviously a new key can be created if the current one has C, and the old one revoked, but that's not the question) to remove or add actions?

Keys' allowed usages can be modified, but the `gpg` tool doesn't support it (even in version 2). To change a key's usage, you need to modify `gpg`. The basic idea is detailed in a thread on the `gnupg-users` mailing list: usage information is carried by the self-signature, so you need to change the usage parser to force the value you're interested in, then create a new self-signature on your key, for example by changing your key's expiry date.