A security team encrypts a laptop's data partition with LUKS using a single passphrase. Before deploying the laptop to a user, you must add a second recovery passphrase to the volume without destroying the existing data or the current passphrase. The device is /dev/sda3. Which command accomplishes this?