@silverpill there's no mechanism to stop you updating an actor's public keys, but that breaks an assumption that's being made in the GoActivityPub logic, which is that key rotation is handled out of band using CLI tools that handle both the private key and update the Actor.
So, after such an update there would be a mismatch between the private key used by the internals of the library and the key retreived by other servers to check.
I haven't found a clean way to do this operation with a better UX sadly, so CLI is all we have.