Ideally, I'd have 2 webauthn tokens, one that I keep on myself, and one that I have at a secure, off site location (like a safe deposit box, if you consider tha

Ideally, I'd have 2 webauthn tokens, one that I keep on myself, and one that I have at a secure, off site location (like a safe deposit box, if you consider that secure). The problem is you need to physically posses the backup key to register it to any new services you might sign up for. Yubikey has proposed a webauthn extension to support this usecase[0]. Unfortunately it requires both changes to both hardware and server side webauthn libraries, so it will likely be years before this would actually be a viable solution. [0]: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...