You can enable ADP (unless you’re in the UK) and then they can’t recover the key either. But the risk then is that if you lose the device your data is gone for good (unless you have a backup and that opens you up for a whole other list of potential threats).