In my testing you need to have local recovery checked, key recovery enabled and auto-encrypt turned on.
I think it only works for new users that are enrolling, not existing users with keys on the universal server. could that be why you aren't getting prompted for the 5 recovery questions?