I changed this around to do passcode verification first, followed by any necessary creation/update.  Rule of thumb is: we always want to have the old passcode / key available before we start changing or removing it.