The backup would be another hardware token, ideally. Just one that isn't biometric. You would guard physical access to that token more closely. Google's Advanc

The backup would be another hardware token, ideally. Just one that isn't biometric. You would guard physical access to that token more closely. Google's Advanced Protection Program enforces two keys, since they also make recovery much stricter.