+1

> a more enterprise solution where I can store a recovery key centrally that a user can’t remove.

The enterprise solution is to not give users administrative privs.