is it possible to have more than one preAuthKey active at one time?

(I want to use one for internal LAN use, and one for external LAN use -
with the intent of being able to quickly disable access originating from outside the building)

how do you disable a preAuthKey ? or do you just create a new one?

again, the goal is to be able to stop access originating from outside the local LAN.