RecoveryKeyRotationId
Identifies one recovery key rotation statement: 32 bytes, SHA-256 over the domain KSecureMessage-RecoveryKeyRotationId-v1 and the statement. The server records the ID of the rotation that installed the current recovery key, so a retry of the same rotation is recognized. Never an authorization.