imo you should always have at least two 2fa hids in case one gets damaged or lost or whatever and you need to force log yourself out or something.