[4ad]

This is why you need to enrol the secondary passkey at the same time you enrol the first one, not later when you might not have the authenticator present.

In reality websites should not allow setting up a single passkey.

[cuu508]

Enrolling both at the same time still requires both authenticators to be present at the same machine/physical location.

[e12e]

Problem remains when you lose one, and need to block and enroll a new backup?

[radicality]

Apple actually forces you to use 2 keys when setting up security keys for iCloud, just did the setup few weeks ago.