The FDE key on the portal was not valid as it had changed so was unable to recover the mac had to DFU it.

I would like to see FDE keys being updated in the portal when they're changed / or at least checked ( sudo fdesetup validaterecovery ) with a valid/invalid flag against the device in the portal.