...except this one.  In advance of encryption changes/updates, I want to make sure encryption upgrade functionality is called before any passcode-based operations could throw a wrench into that process.  As `SFSecurityLockout` is the gatekeeper for user-initiated passcode changes, seems like the place to do it.