For the transition, I am using a task sequence to pause BL, copy the recovery key elsewhere, even create a (second) specific numericalpassword (aka recovery key) protector to do everything possible to retain recovery ability if BL happens to be tripped during the migration activity. I'm debating on removing protections as another layer to try and remove SafeGuard. Even with all this my IT staff will be hands on for it and user data is backed up per other processes.