If we trust the key backup at upgrade time then we can sign it so key backup will work automatically when cross-signing is trusted. If we don't sign it at this point we'll end up with cross-signing and key backup set up but key backup untrusted by the cross-signing key which is a bit of a broken situation. With https://github.com/matrix-org/matrix-js-sdk/pull/1144 fixes https://github.com/vector-im/riot-web/issues/11747