You use out of band non yubi key mfa and contact your support and they give you a new one. Been using them for a while it’s really not too much of a challenge.

You use out of band non yubi key mfa and contact your support and they give you a new one. Been using them for a while it’s really not too much of a challenge. Also you just keep a bucket of non signed up ones at the office. Enrolling them is pretty easy.