There aren't three passwords; there are two: an account password and a recovery passphrase/key. It's the same as (say) macOS - where you have a login password to get into your computer, and a recovery key for FileVault in case of disasters.

However, the feedback is overwhelmingly that we need to iterate on the recovery passphrase - either making it a generated key (like macOS does), or going the whole hog and replacing the login password entirely with the cryptographic recovery one.

Turns out the UX on this stuff is tough.