If encryption to a group fails (or even when creating a group) we need to make it easy for the users to check why the can not encrypt to a group. They need to see which key is to blame.
The "Edit Group" window would be a good place for that. Problems would become visible immediately on creation of the group. If a key in the group expires later and encryption to the group does not work any more, the user could then check the group menu.
Lets add a column "encryption possible" (name could be shorter, I admit) on the left side with the icons "checkmark" (green, VSD compliant encryption possible), "!" (blue, possible but not compliant) and "X" (red, no encryption possible).
We could then still allow to put all kinds of keys in the group, even revoked or sign-only keys. And T6722 would no longer be needed IMHO. To clarify that groups can only be used for encryption if no key has an X in the first column, we should add a short sentence near the top of the "edit group" window ~"If the group is to be used for encryption, no certificate with the icon X in the first column can be included." I'd like that info in fat print, to be more noticeable.