Even better: create an admin policy to allow us to enforce skipping the decrypt-with-old-password box entirely (just assume forgot old password and proceed anyway)

An admin policy like the one mentioned in comment #3 would help us quite a bit.

On our large Chromebox fleet, we presently have them all configured to purge user data at logout to workaround the issue of passwords being out of sync.  We don't really care about losing locally saved data, but it would be nice to be able to keep local data present so Chrome Sync doesn't have to happen at every single login.