As you say, it's because WebAuthn is by design tied to the origin and onion sites are a different domain. There's been attempts to standardise a way to indicate

As you say, it's because WebAuthn is by design tied to the origin and onion sites are a different domain. There's been attempts to standardise a way to indicate that site XYZ.onion is actually the same as ABC.com through the Alt-Svc header but it seems unlikely that this would be used by something as security critical as WebAuthn. I suspect the reason you can't enroll the same key again is that Twitter doesn't know that you're accessing it from an onion address? Or it doesn't know how to register the same key twice with different domains? I agree it should be possible.