Support live updating the restricted mode config and keys

The following discussion from !2266 (merged) should be addressed:

• @Diziet started a discussion: (+2 comments)

  What about updates? For most config stuff we watch for config changes, and automatically apply them.

  It's not clear to me how things are expected to work here. Is a config reload going to be sufficient to apply the changes to running services?

  Certainly the behaviour (and any limitations) should be clearly documented.