> If the user does not have their old device or a security key, then the RP can treat sign-in from the new device (which might be from a different vendor) as a

> If the user does not have their old device or a security key, then the RP can treat sign-in from the new device (which might be from a different vendor) as a normal account recovery situation and take appropriate steps to get the user signed in. LOL. This is not a serious answer.