Another way to say this is that you have to have an account recovery process and you need to think about how your encryption interacts with account recovery.