(Don't do it before or you won't be able to add new ones without the owner key or building a multisig transaction to do it.)

For changing the active authority, this actually doesn't matter since you need the owner key for anyway. You can't chance the active authority with an active key. It doesn't matter if there is an intermediate situation where none of the active keys can reach the active threshold.
edit: You are right, it is possible to change the active auth with active keys - using the owner key in the first place is an easy workaround.
It makes a difference though, if the owner authority is changed. But in that case it's probably better to use a script like mine and set them all at once unless you're OK with waiting one hour after each change.