Until hardware security devices support "identical twins" in some way, they're simply too impractical. For them to be practical for all accounts, not just the m

Until hardware security devices support "identical twins" in some way, they're simply too impractical. For them to be practical for all accounts, not just the most sensitive few, you need to be able to have another key stored in a secondary secure location. Something like: when you enroll your primary, it automatically tells the site about your secondary key. The secondary is protected by a PIN and has equivalent validity as the primary and if it's ever used, the site notifies you. If your primary is lost or stolen, you can use your secondary with the help of your "password" manager to automatically revoke the old primary on all accounts. When you buy a new secondary, the same protocol can be used to inform sites to trust it, after which you put in back in storage.