I don't think you can. Afaik, bypassing the new AP can be done on 9.5
emuNAND, not sysNAND. Maybe I'm wrong though.
Anyway, someone (some said he was a troll, some said he was right) said that HANS could bypass the new AP, but I have no means of verifying that.
In any case, don't update, since 9.5 is the last FW without the new encryption on N3DS, so you'll be able to downgrade to 9.2 if a ARM11 kernel exploit is found