FileVault key stored in iCloud while not opting for it

[DaanQ]

Hello! I have a small issue with understanding the logic behind the recovery methods of FileVault in macOS High Sierra. I have read Apple support articles and also contacted Apple Support on Twitter, but they sent me the same support articles I already read. I also posted my question on the Apple Communities forum but unfortunately no one seems to answer. Perhaps you guys can help me out.

So the story behind my misunderstanding goes as follows: during the computer's initial setup I enabled FileVault and I chose to store a recovery key on iCloud instead of storing it offline myself. However I changed my mind, decrypted the disk, encrypted it again but this time made sure to not use iCloud for the recovery key. I thought everything was okay until I checked the Reset Password Assistant. When I went into the Reset Password assistant, I was able to login using my Apple ID and it automatically retrieved a recovery key which allowed me to reset my password. I assumed this shouldn't be possible since I opted for an offline recovery key for FileVault. To eliminate the possibility I made a mistake, I decrypted and encrypted the disk again. Before encrypting it again, I removed my home network in the WiFi settings, turned off the WiFi and restarted the Mac. I thought this would perhaps prevent my Mac from sending a recovery key to iCloud. And by the way, under Users & Groups I didn't enable "Allow user to reset password using Apple ID" (this option also disappears when enabling FileVault). Despite this, the issue persists.

These are the articles that didn't really help me with finding an answer:

1. "Use FileVault to encrypt the startup disk on your Mac": https://support.apple.com/en-us/HT204837
2. "Change or reset the password of a macOS user account": https://support.apple.com/en-us/HT202860

Apple is not completely clear about which steps you should find in the Reset Password assistant depending on which recovery method you selected. And the support articles only show the first step of Reset Password assistant. Unfortunately I didn't find any other websites about macOS High Sierra online that could explain my issue. I only found an article about FileVault in Yosemite (see here). The Reset Password assistant looks very similar to the one in macOS High Sierra. In the article they show the available steps for when you opted for a recovery key through iCloud and for when you chose to store the recovery key yourself. Although I selected to not use iCloud, I am still able to use the same steps as when I would have selected the iCloud option. Instead I would have expected the Reset Password assistant to display a message similar to the one showed in the Yosemite article (see here).

So to conclude: I expected not to be able to use my Apple ID in the Reset Password assistant to retrieve the Recovery Key for FileVault as I selected the option "Create a recovery key and do not use my iCloud account". I would only expect the Reset Password assistant to retrieve my Recovery Key when I would have selected "Allow my iCloud account to unlock my disk". Since my Recovery Key was still retrieved through iCloud, I fail to understand why the option is offered to store the Recovery Key yourself without using iCloud as it seems that Apple still has access to the Recovery Key when you sign in using your Apple ID (even though the option to not use iCloud was selected before encryption).

Excuse me for the long post, but I hope I explained the issue well enough. Perhaps you guys know what's going on? Or perhaps you could check how the Reset Password assistant behaves on your Mac (in case you also opted for the offline recovery key)?