geli setkey. To change from an existing key + phrase to a new key + phrase, you need to specify both the old and the new pair, like so:
$ geli setkey -v -k /boot/old.key -K /boot/new.key /dev/md9
Enter passphrase: oldphrase
Enter new passphrase: newphrase
Reenter new passphrase: newphrase
Decrypted Master Key 0.
Note, that the master key encrypted with old keys and/or passphrase may still exists in a metadata backup file.
If your old key had no passphrase, add
-p, and if you want your new key to be without a passphrase, add
-P. You do not need to detach first, and you certainly do not need to copy all your data around. Do keep a backup of your metadata for peace of mind, and don't forget to update it after changing keys/passphrases.
Important: If you are using boottime passphrase entry (for encrypted root partitions) and are changing from a key + phrase to key without passphrase (
-P above), you must also disable the boottime passphrase prompt with
geli configure -B. Furthermore, if you changed keyfile locations, you need to edit
/boot/loader.conf to point to the new keyfile.