Only users with the secret key for the certificate should be able to upload certificates to an LDAP keyserver.
This should be activatable via a configuration option (i.e. a registry setting in Windows).
In Kleopatra the option to upload will be greyed out for public keys if the option is set.
This does not affect the capabilities of the command line.