Using local key generation, the flag 'markAsKeyRecoverable' in KeyRecoveryData is set in the requesting instance database before the operation is approved (if approvals is enabled for key recovery). This is done because there's no way for the CA to change the flag in the RAs database.

If the request is approved, everything works as intended. However, if it's rejected, the CA cannot reset the flag in the RAs database which means a new request cannot be made for key recovery.