A user with sso_role or keycustodian_role can recover the master or dual master key.
alter encryption key [dual] master with passwd char_string recover encryption with passwd char_string
where the first reference to passwd is the password to the recovery key copy and the second reference to passwd is the new password for the base key.