When setting up encryption without a TPM, or when TPM fails, the user is prompted for the recovery key. This key, as the user types, is displayed on the screen. As a security feature, this key should not be displayed as the user is typing much like when they enter their password to login.

Single change to the ask_input command to add no_echo=True will fix this