When you --gen-key in GPG, you can choose which actions of Sign, Certify, Encrypt, and Authenticate the key will be usable for.

Can these be later modified (i.e. obviously a new key can be created if the current one has C, and the old one revoked, but that's not the question) to remove or add actions?

2 Answers 2


Keys' allowed usages can be modified, but the gpg tool doesn't support it (even in version 2). To change a key's usage, you need to modify gpg. The basic idea is detailed in a thread on the gnupg-users mailing list: usage information is carried by the self-signature, so you need to change the usage parser to force the value you're interested in, then create a new self-signature on your key, for example by changing your key's expiry date.

  • 1
    Ouch, I think I'll chalk that up as 'not worth the effort' - thanks though!
    – OJFord
    Jan 24, 2017 at 16:11
  • 2
    I just noticed that gpg version 2.2.6 has this feature with the change-usage subcommand. See security.stackexchange.com/a/206766/4350
    – David Xia
    Sep 19, 2021 at 21:31

change-usage is the hidden subcommand that will change the allowed action.

$ gpg --edit-key $KEYID

gpg> change-usage
Changing usage of the primary key.

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection?

Sources -

  1. Detailed explanation is given in this answer given by sanmai to another question.
  2. Above link is also mentioned in the comment given by David Xia on the Stephen Kitt's answer to this question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .