You use the same model as SSH: give a big warning with klaxons "Warning, this site's SSL certificate has changed, it is possible that you are being actively attacked" and then force the user to dig into an text file and manually remove the offending memorized entry (no prompt for saying "Ignore and carry on"). The hope being that an inexperienced user would find someone more competent to help them out.

There are loads of ways this could go wrong (the phishing website earnestly telling the user that they "changed" their SSL key and that you need to follow these simple steps to "fix" your browser; the initial contact being the bogus website; the huge loss of traffic if your SSL key legitimately changes and you're not prepared; you need to deal with revocation).

I normally contact someone who is on a completely different internet connection to myself. I asked a friend of mine who lives the other side of the world to tell me what he saw the cert in question as, and it did not match the cert I was being given, so I rejected it.