This script will call a policy from the JSS to issue a new recovery key if it detects that the recovery key has been used to log in.

recoveryKeyCheck.sh

#!/bin/bash

# Automatic FV2 Individual Recovery Key re-issue script
# written by John Kitzmiller - www.johnkitzmiller.com
#
# This script will call a policy from the JSS to issue a new recovery key
# if it detects that the recovery key has been used to log in
#

### Functions ###

function jssCheck()
{
	# Checking to make sure the JSS is available before proceeding
	jamf checkJSSConnection -retry 0
	until [ $? = 0 ]
		do
			sleep 5
			jamf checkJSSConnection -retry 0
		done
}

## Main Program ###

# Check to see if recovery key was used to log in
recoveryKeyUsed=$(fdesetup usingrecoverykey)

if [ "${recoveryKeyUsed}" == "true" ]
	then
		jssCheck
		# Call JSS policy to issue new recovery key
		jamf policy -event issueNewRecoveryKey
fi

exit 0