MacOS – Prompt for encrypted disk password on startup

It looks like this is a misunderstanding. In the later versions of macOS it is difficult to distinguish the pre-boot unlock screen (where one unlocks the partition and is automatically logged in after the boot process) from the login screen (where the system partition is already unlocked and the user has to log into the system).

Furthermore, FileVault2 can grant multiple passwords the right to unlock the partition and grants this permission to individual accounts. You can manage what accounts can unlock the system disk in System Preferences>Security & Privacy>Enable Users.... That means your account password also becomes the password to unlock the partition. In any case you can use the recovery password, which is provided when encrypting the disk, to unlock the partition.

This answer provides a method to use a unlock key that differs from your account password.

As it turns out, I found the answers to most of this not long after I asked the question. The command-line fdesetup program offers some additional options.

Removing Disk Password

Run sudo fdesetup list -extended and look for the UUID labeled "Disk Passphrase". Then run sudo fdesetup remove -uuid <UUID> to remove it.

This can be used to remove the disk password that was created via Disk Utility, leaving only user login passwords for unlocking the disk.

Removing User from FileVault

Run sudo fdesetup list (-extended isn't needed) to see what users are authorized to unlock the disk, then use sudo fdesetup remove -user <USER> or sudo fdesetup remove -uuid <UUID>.

This can be used to de-authorize users so that only the disk password can be used.

Adding Recovery Key

Run sudo fdesetup changerecovery -personal. This will prompt for a password (anything that's currently enabled to unlock the disk), then display the new recovery key. (Write it down!)

Removing Recovery Key

Run sudo fdesetup removerecovery -personal. As above, this will prompt for a password.

Adding Disk Password

I couldn't find a way to do this in-place — sudo diskutil cs passwd seems like it ought to work, but it requires there to be an "old" disk password already.

However, you can turn off FileVault using the preferences window (which decrypts the disk), then use sudo diskutil cs encryptLV <UUID> to re-encrypt it with a disk password. This is slow, since it has to decrypt and re-encrypt all the data, but it works.