In the FileVault section of the macOS overview, I think it would be helpful to mention that by default your FileVault will store your encryption recovery key on iCloud. On Apple Silicon macs, the process to change your key involves turning off FileVault (which is nearly instantaneous) and reenabling and choosing not to store the recovery key on iCloud.
Depending on a person’s threat model, iCloud storage may be problematic and if you set up FileVault on first boot, it doesn’t tell you it will store it on iCloud.
This section of a guide on GitHub is more detailed than what is needed imo but I think that making people aware of the iCloud storage of the recovery key is important.
Text from linked GitHub hosted guide:
All Mac models with Apple silicon are encrypted by default. Enabling FileVault makes it so that you need to enter a password in order to access the data on your drive. The EFF has a guide on generating strong but memorable passwords.
Your FileVault password also acts as a firmware password that will prevent people that don’t know it from booting from anything other than the designated startup disk, accessing Recovery, and reviving it with DFU mode.
FileVault will ask you to set a recovery key in case you forget your password. Keep this key stored somewhere safe. You’ll have the option use your iCloud account to unlock your disk; however, anyone with access to your iCloud account will be able to unlock it as well.