Hm shit I forgot to answer this.

Step 1: go to a frontend that allows for recovery:

https://hivetasks.com/account-recovery

Your recovery buddy types in your account name and pastes in a new public key

Then you sign this operation with a key that was valid within 30 days in addition to the new key (to make sure the account doesn't get sent to the void).

I think that's pretty much it.
I described it wrong (backwards) in the original post but whatever.