You can generate a new recovery key anytime once the volume is decrypted/booted:

    sudo fdesetup validaterecovery  # check
    sudo fdesetup changerecovery -personal  # change

Obviously this doesn't reencrypt the disk, so you can guess how it works.