I’m not sure I understand the case you’re making. The fact that many sites have horrible implementations of MFA, where you can only enroll a single U2F device,

I’m not sure I understand the case you’re making. The fact that many sites have horrible implementations of MFA, where you can only enroll a single U2F device, couldn’t possibly have been the “good reason for creating key material external to the token”, because creating key material external to the token isn’t a feature of mainstream U2F tokens, it’s something that has been historically supported by GPG hardware devices. Yes, those sites should implement U2F support better, but the question was about why U2F is more secure than GPG, and ~“because it’s harder to mishandle the private key during setup” is pretty solidly an accurate answer.