DeviceRecoveryId
Identifies one recovery statement: 32 bytes, SHA-256 over the domain KSecureMessage-DeviceRecoveryId-v1 and the statement. The server records the ID of the recovery that installed a device's current key, so a retry of the same recovery is recognized. It is never an authorization.