1. Disable cross-signing lab
2. Ensure your account has no cross-signing or secret storage keys (blow away account data if needed)
3. Create a key backup
4. Sign out and in so that the key backup exists but is not yet trusted by the device
5. Enable cross-signing lab
6. Refresh and see a "verify this session" toast
7. Click "verify"
8. Enter account password in dialog
9. Enter backup passphrase in dialog

The dialog then just closes without finishing the upgrade process.