On the Critical Updates page, it is possible to activate and deactivate Critical Updates, but only up until the auto-activation date. See here:
To ensure a smooth transition, each update has an opt-in period during which you can manually activate and deactivate the update an unlimited number of times to evaluate its impact on your organization and modify affected customizations as necessary. The opt-in period ends on the auto-activation date, at which time Salesforce permanently activates the update.
For sandboxes, the auto-activation date for TLS 1.0 Disablement was June 25, 2016, at 9:30 AM PDT (16:30 UTC). See here:
After this date and time, all sandbox orgs -- whether existing, refreshed, or new -- will have TLS 1.0 automatically disabled and will require TLS 1.1 or later in HTTPS connections to or from the sandbox org. The "Require TLS 1.1 or higher for HTTPS connections" CRUC setting will not be available.