According to the pax.grsecurity.net website, chpax is obsolete in favor of paxctl. But some ebuilds list chpax as a DEPEND. In particular, can gradm depend on paxctl instead of chpax? Frankly, I don't see why gradm should depend on either, but I'll let you guys think about that. :)
gradm does not really need to depend on either. But I'd found it to be a complete PITA when users don't even have the basic tools installed so I force a dep of chpax on you. Now with paxctl it can not be a dep cuz things that paxctl depends on are still in ~arch In due time paxctl will be the dep.. But not today or probably for a few more months.