I was able to debug the firmware using a WCH-linkE connected to PB14/PB15 (SWDIO/SWDCLK).

Before using the debug port:

• Enable debug port by wchisp config enable-debug and wchisp config unprotect while in the isp mode (bootloader). Firmware flash will be erased.
• Cut the trace of PB14/PB15 to the LED, and connect it to the WCH-linkE dongle. For more details see Correcting the debug port badgemagic-hardware#31.
• Flash the firmware to 0x00000000 using wlink and the WCH-linkE dongle over the debug port.

Further details need to be investigated to set up OpenOCD.