Change a key's allowed actions in GPG?

Question

When you --gen-key in GPG, you can choose which actions of Sign, Certify, Encrypt, and Authenticate the key will be usable for.

Can these be later modified (i.e. obviously a new key can be created if the current one has C, and the old one revoked, but that's not the question) to remove or add actions?

Answer 1

Keys' allowed usages can be modified, but the gpg tool doesn't support it (even in version 2). To change a key's usage, you need to modify gpg. The basic idea is detailed in a thread on the gnupg-users mailing list: usage information is carried by the self-signature, so you need to change the usage parser to force the value you're interested in, then create a new self-signature on your key, for example by changing your key's expiry date.

Answer 2

change-usage is the hidden subcommand that will change the allowed action.

$ gpg --edit-key $KEYID

gpg> change-usage
Changing usage of the primary key.

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection?

Sources -

1. Detailed explanation is given in this answer given by sanmai to another question.
2. Above link is also mentioned in the comment given by David Xia on the Stephen Kitt's answer to this question.