Indeed - the lack of backups in WebAuthn is a design feature (although I can see credible usability issues in online services where users should really enrol se

Indeed - the lack of backups in WebAuthn is a design feature (although I can see credible usability issues in online services where users should really enrol several, but struggle to keep them in different locations and ensure they register their off-site backup key to each service etc.) I presume (but haven't reviewed in detail) that these bio keys will have a backup PIN in the same way previous models had the PIN available for management and WebAuthn modes of operation - there are some real-world failure modes where wet hands or a bandaged finger may be an issue, but the user still wants to keep using it. I do agree the best solution is to get several tokens, enrol them all for each service, and just keep them as safe as you realistically can.