Use hasX instead of canX to check key capabilities

In these cases we also want expired encryption (or signing, ...) keys to
match. Therefore, we need to use the new hasX capability queries.

• GnuPG-bug-id: T6743