If I were a CISO solving this problem today, I would just use TOTP instead of U2F, and store the secret in two places. Longer term I expect AWS will add this c

If I were a CISO solving this problem today, I would just use TOTP instead of U2F, and store the secret in two places. Longer term I expect AWS will add this capability.