Here you go - https://github.com/shbedev/jamf-recovery-lock 

I know you can SetRecoveryLock during DEP... but how do you turn it off after that? 

You can use the API to set an empty password, which will turn it off - If you are comfortable using python you the script I mentioned above. 

Are there any directions in how to invoke the API? 

Anyone know if this tool or the recovery_lock_key API command also enables the 60 minute key rotation or can that only be done through the PreStage?

At the moment, the key rotation is only supported when recovery lock is enabled through PreStage.

That's what I figured - thanks for confirming!

You upvote is welcomed:

https://snelson.us/2022/06/view-recoveryos-password/

You can find our script here https://gist.github.com/ExperimentalHeaven/09eeafa1122dd4bbac30cb9b91309b52
Simple bash with the use of jq to make the parsing easier