correct handling of keychain upgrade when device passcode is disabled