Earlier quoted context omitted.
And how do you enroll the second device? It would have to be something like; 1) Login on primary device 2) Generate a one-time code or link 3) Enter one-time code or click link on 2nd device 4) Click an “Enroll” button on the 2nd device which would generate a second enrollment saved in the account. You would have to do this for each and every service so that seems like a total non-starter. Alternatively, a way to sha…
There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature counter set, so first use invalidates original (on loss). But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site".
This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few months and add it to all of the new services I have enrolled in, but I don't have a good system for remembering all of these services, so I inevitably forget one (despite only using the key on a few services)...