When assigning keys, the Access Rights check boxes should default to 'yes'. The owner can then choose to restrict those rights if they want. The current arrangement adds a bit of unnecessary tedium and can be forgotten if someone doesn't issue keys on a regular basis.

Anyway to clear out old inactive keys automatically as well?

soon(tm)

Old keys can be reused. As such it may be undesirable to delete keys that become inactive. It is technically possible to do what you want, and there are plugins that can do so.

When assigning keys, the Access Rights check boxes should default to 'yes'.

+10000 To this ^

Sensible defaults are important, and with the way the key system currently works, being able to change permissions on user keys is totally useless.