LastDeviceRecoveryId
Identifies one last-device recovery statement: 32 bytes, SHA-256 over the domain KSecureMessage-LastDeviceRecoveryId-v1 and the statement. The server records the ID of the recovery that installed a device's current key, so a retry of the same recovery is recognized. Never an authorization.