You can generate a new recovery key anytime once the volume is decrypted/booted: sudo fdesetup validaterecovery # check sudo fdesetup changerecovery -

You can generate a new recovery key anytime once the volume is decrypted/booted: sudo fdesetup validaterecovery # check sudo fdesetup changerecovery -personal # change Obviously this doesn't reencrypt the disk, so you can guess how it works.