There was a good reason for creating key material external to the token though, even though it's objectively more secure to let the token generate it. In the pa

There was a good reason for creating key material external to the token though, even though it's objectively more secure to let the token generate it. In the past(and possibly this is still the case) most sites had flawed U2F implementations, in the sense that you could only register one U2F key to an account (or rather, you could normally only pick one instance of any supported 2FA method e.g. SMS). If your U2F token was lost or damaged it would thus permenantly render your accounts inaccessible (depending on whether or not account recovery bypasses U2F), and the best practice to avoid that was to have two tokens initialised with the same key material and to keep one in a safe place at home / bank safe-deposit box / other secure location. Then, if you needed to regain control you still had a valid U2F token. As U2F gains traction more sites are implementing it properly with multi token support, which renders this method obsolete, but that's the historical reasoning.